CVE-2025-46559: Misskey Path Traversal Vulnerability

CVE-2025-46559 Overview

CVE-2025-46559 is a path traversal vulnerability [CWE-22] affecting Misskey, an open source federated social media platform. The flaw exists in the Mk:api function used by AiScript, Misskey's scripting language for plugins and widgets. Missing URL validation allows malicious AiScript code to prefix endpoint paths with ../ to escape the /api directory. This grants access to unintended endpoints including /files, /url, and /proxy. The vulnerability affects versions from 12.31.0 up to but not including 2025.4.1.

Critical Impact
Attackers can leverage AiScript plugins to access internal Misskey endpoints outside the API namespace, exposing file handling, URL preview, and proxy functionality to untrusted script execution.

Affected Products

Misskey versions 12.31.0 through 2025.4.0
Misskey instances running AiScript plugins or widgets
Federated Misskey deployments accepting third-party AiScript code

Discovery Timeline

2025-05-05 - CVE-2025-46559 published to NVD
2025-09-03 - Last updated in NVD database

Technical Details for CVE-2025-46559

Vulnerability Analysis

Misskey exposes an Mk:api function to AiScript code, allowing scripts to call backend endpoints under the /api path. The function accepts an endpoint string from the caller and concatenates it with the /api prefix to construct the request URL. The implementation does not validate or normalize the endpoint string before use.

An attacker writing AiScript can supply an endpoint value beginning with ../, causing the resolved URL to traverse outside the intended /api directory. This redirects the request to sibling routes such as /files, /url, and /proxy, which were never intended to be reachable from AiScript. These endpoints handle media files, URL preview generation, and proxy requests, which broadens the attack surface available to plugin authors and embedded widgets.

The issue is confidentiality-focused: the vector enables unauthorized read access to resources, while integrity and availability impacts are not indicated by the CVSS vector. The vulnerability was fixed in Misskey 2025.4.1.

Root Cause

The root cause is missing input validation in the Mk:api AiScript binding. The endpoint argument is trusted as a relative path within /api but is never checked for traversal sequences or path normalization before being appended to the base URL.

Attack Vector

Exploitation requires that an attacker can run AiScript on a target Misskey instance. This is achievable through plugins, widgets, or other AiScript execution contexts exposed to users. The attacker crafts a script that invokes Mk:api with an endpoint such as ../files/<id> to reach non-API routes.

// Conceptual exploitation pattern (sanitized)
// AiScript caller passes a traversal-prefixed endpoint to Mk:api
// Mk:api('../files/<resource>', { ... })
// Resolved URL becomes /files/<resource> instead of /api/../files/<resource>
// granting access to endpoints outside the /api namespace

Detection Methods for CVE-2025-46559

Indicators of Compromise

AiScript plugin or widget code containing Mk:api calls with ../ sequences in the endpoint argument
HTTP access logs showing requests originating from AiScript contexts targeting /files, /url, or /proxy endpoints with unusual referrers
Unexpected proxy or file access patterns correlated with plugin installations or widget loads

Detection Strategies

Audit installed AiScript plugins and custom widgets for string literals containing ../ passed to Mk:api
Inspect Misskey reverse proxy or web server access logs for traversal artifacts in request paths originating from authenticated client sessions
Monitor outbound proxy fetches from /proxy endpoints that correlate with AiScript-driven user sessions

Monitoring Recommendations

Enable verbose request logging on the Misskey backend and forward to centralized log analysis
Alert on access to /files, /url, and /proxy endpoints from origins or sessions that primarily interact with /api
Track installed plugin inventory and review code diffs after updates from untrusted authors

How to Mitigate CVE-2025-46559

Immediate Actions Required

Upgrade Misskey to version 2025.4.1 or later, which contains the validation fix
Inventory installed plugins and widgets and remove any that originate from untrusted sources
Review server logs for prior abuse of /files, /url, and /proxy endpoints via AiScript

Patch Information

The fix is included in Misskey 2025.4.1. The change is delivered in commit 583df3ec63e25a1fd34def0dac13405396b8b663. Administrators should also review the GitHub Security Advisory GHSA-gmq6-738q-vjp2 for full vendor guidance.

Workarounds

Disable AiScript plugin and widget functionality on the instance until the upgrade is applied
Restrict plugin installation to a vetted allowlist of audited scripts
Place a reverse proxy rule in front of Misskey that blocks request paths containing ../ sequences before they reach the application

bash

# Example nginx rule to block traversal sequences
location / {
    if ($request_uri ~* "\.\./") {
        return 400;
    }
    proxy_pass http://misskey_backend;
}