CVE-2025-13481

CWE-78 — OS Command Injection3 documents3 sources
Severity
8.8HIGH
EPSS
0.1%
top 77.38%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Aspera Orchestrator
Timeline
PublishedDec 11

Description

IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDibm/aspera_orchestrator4.0.0 — 4.1.1
▶CVEListV5ibm/aspera_orchestrator4.0.0 — 4.1.0

🔴Vulnerability Details

2
CVEList
IBM Aspera Orchestrator Command Injection↗2025-12-11
▶
GHSA
GHSA-82p3-cwp7-9pjw: IBM Aspera Orchestrator 4↗2025-12-11
▶
CVE-2025-13481 (HIGH CVSS 8.8) | IBM Aspera Orchestrator 4.0.0 throu | cvebase.io