CVE-2025-9800: SimStudioAI Unrestricted File Upload Vulnerability

CVE-2025-9800 Overview

CVE-2025-9800 is an unrestricted file upload vulnerability in SimStudioAI sim, an open-source AI workflow platform. The flaw resides in the Import function of apps/sim/app/api/files/upload/route.ts within the HTML File Parser component. Attackers with low privileges can manipulate the File argument to upload arbitrary files remotely. The vulnerability is classified under [CWE-434] Unrestricted Upload of File with Dangerous Type and [CWE-284] Improper Access Control. The project operates on a rolling release model, so no versioned release identifiers are available. A public exploit disclosure exists, and a patch has been committed as 45372aece5e05e04b417442417416a52e90ba174.

Critical Impact
Authenticated remote attackers can upload files of arbitrary types through the HTML File Parser endpoint, enabling potential delivery of malicious content into the sim application storage layer.

Affected Products

SimStudioAI sim (rolling release up to commit ed9b9ad83f1a7c61f4392787fb51837d34eeb0af)
Component: HTML File Parser (apps/sim/app/api/files/upload/route.ts)
Deployments consuming the affected Import function without the remediation commit applied

Discovery Timeline

2025-09-01 - CVE-2025-9800 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9800

Vulnerability Analysis

The vulnerability exists in the file upload route handling of the SimStudioAI sim platform. The Import function in apps/sim/app/api/files/upload/route.ts accepts a File argument from HTTP requests without validating its extension or MIME type against an allowlist. This permits an authenticated user to submit files of any type, including executable scripts and content that can be rendered dangerously by downstream consumers.

The HTML File Parser context makes the issue relevant to workflow imports, where parsed content may later be served, rendered, or processed by other components. The rolling release model means no version numbers gate exposure; only the presence of the remediation commit 45372aece5e05e04b417442417416a52e90ba174 differentiates vulnerable from fixed deployments. Refer to GitHub Issue Tracker #958 for the reporter discussion.

Root Cause

The root cause is missing input validation on the uploaded file extension. Prior to the fix, the upload handler did not enforce an allowlist of permitted extensions, allowing any filename to pass through. Improper access control ([CWE-284]) compounded the file type checks ([CWE-434]), permitting low-privileged callers to reach the ingest logic.

Attack Vector

Exploitation is performed over the network against the file upload API endpoint. An attacker with valid low-privilege credentials sends a crafted multipart request containing a file with a disallowed or dangerous extension. The server accepts and stores the file, providing a foothold for follow-on attacks depending on how the artifact is consumed. Public exploit information is available through the vendor issue tracker.

typescript

// Patch: apps/sim/app/api/files/upload/route.ts
   InvalidRequestError,
 } from '@/app/api/files/utils'
 
+// Allowlist of permitted file extensions for security
+const ALLOWED_EXTENSIONS = new Set([
+  // Documents
+  'pdf',
+  'doc',
+  'docx',
+  'txt',
+  'md',
+  // Images (safe formats)
+  'png',
+  'jpg',
+  'jpeg',
+  'gif',
+  // Data files
+  'csv',
+  'xlsx',
+  'xls',
+])
+
+/**
+ * Validates file extension against allowlist
+ */
+function validateFileExtension(filename: string): boolean {
+  const extension = filename.split('.').pop()?.toLowerCase()
+  if (!extension) return false
+  return ALLOWED_EXTENSIONS.has(extension)
+}
// Source: https://github.com/simstudioai/sim/commit/45372aece5e05e04b417442417416a52e90ba174

The companion change in apps/sim/app/api/files/utils.ts removes svg from the recognized image MIME map, closing an avenue for stored XSS via SVG payloads:

typescript

// Patch: apps/sim/app/api/files/utils.ts
   jpg: 'image/jpeg',
   jpeg: 'image/jpeg',
   gif: 'image/gif',
-  svg: 'image/svg+xml',
   // Archive formats
   zip: 'application/zip',
   // Folder format
// Source: https://github.com/simstudioai/sim/commit/45372aece5e05e04b417442417416a52e90ba174

Detection Methods for CVE-2025-9800

Indicators of Compromise

Uploaded files in the sim storage layer with extensions outside the allowlist (pdf, doc, docx, txt, md, png, jpg, jpeg, gif, csv, xlsx, xls).
HTTP POST requests to /api/files/upload with filenames ending in executable or scriptable extensions such as .html, .svg, .js, .php, or double extensions.
SVG files previously stored under the image/svg+xml MIME type before the patch was applied.

Detection Strategies

Inspect application access logs for POST /api/files/upload requests and correlate the response filenames or stored paths against the allowlist.
Perform static review of running sim deployments to confirm whether commit 45372aece5e05e04b417442417416a52e90ba174 is present in apps/sim/app/api/files/upload/route.ts.
Scan object storage or filesystem buckets used by sim for files whose extension does not match the patched allowlist.

Monitoring Recommendations

Alert on file upload requests from accounts with abnormal upload volume or non-standard filename patterns.
Track outbound HTTP responses that serve user-uploaded content with MIME types capable of script execution, particularly image/svg+xml and text/html.
Enable audit logging on the sim file storage backend and forward events to a centralized logging pipeline for retention and analysis.

How to Mitigate CVE-2025-9800

Immediate Actions Required

Apply the upstream fix by updating to a sim build that includes commit 45372aece5e05e04b417442417416a52e90ba174.
Audit existing uploads and remove or quarantine any files whose extensions fall outside the patched allowlist.
Rotate credentials for accounts that had upload privileges if unauthorized uploads are detected.

Patch Information

The fix is delivered in commit 45372aece5e05e04b417442417416a52e90ba174 titled fix(files): fix vulnerabilities in file uploads/deletes (#1130). It introduces the ALLOWED_EXTENSIONS allowlist and validateFileExtension helper in the upload route, and removes SVG from the accepted MIME map in utils.ts. See the GitHub Commit Notification and the GitHub Comment on Issue #958 for details.

Workarounds

Place a reverse proxy or web application firewall rule in front of /api/files/upload that rejects requests carrying disallowed file extensions or dangerous MIME types.
Restrict access to the upload endpoint to authenticated users on trusted networks until the patched commit is deployed.
Serve user-uploaded content from a sandboxed domain with a strict Content-Security-Policy and Content-Disposition: attachment to inhibit inline rendering.

bash

# Example nginx rule to block dangerous extensions at the edge
location /api/files/upload {
    if ($request_method = POST) {
        set $blocked 0;
        if ($http_content_disposition ~* "filename=\"[^\"]+\.(html?|svg|js|php|phtml|jsp|exe|sh|bat)\"") {
            set $blocked 1;
        }
        if ($blocked = 1) { return 415; }
    }
    proxy_pass http://sim_upstream;
}