CVE-2025-49493

published 2025-06-30

CVE-2025-49493: Akamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE) injection.

Priority P1 81 medium 5.8 CVSS 3.1

AV N AC L PR N UI N S C C L I N A N

ITW EXPLOIT VulnCheck KEV

Akamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE) injection.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
akamai	cloudtest	< 12988	12988

Detection & IOCs extracted from sources · hover to see the quote

sigma↗

matchers:
- type: dsl
  dsl:
  - 'contains(interactsh_protocol, "dns")'
  - 'contains(content_type, "text/xml")'
  - 'contains(body, "XML stream")'
  condition: and

• → Successful exploitation is confirmed by three concurrent conditions: an OOB DNS callback (interactsh_protocol == dns), a response Content-Type of text/xml, and the string 'XML stream' present in the response body. Monitor for all three together. ↗
• → Vulnerable versions are Akamai CloudTest before build 60 2025.06.02 (12988). Any instance running an older build accepting XML input should be treated as exploitable. ↗

• · The digest hash at the end of the template is a Nuclei template integrity/signing digest, not a malware hash. It should not be used as a file-based IOC. ↗

CVSS provenance

nvd v3.1 5.8 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

vulncheck 5.8 MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-611