Arbitrary file upload in Aveva Pi Integrator
CVE-2025-54460
The vulnerability, if exploited, could allow an authenticated miscreant (with privileges to create or access publication targets of type Text File or HDFS) to upload and persist files that could potentially be executed.
Vulnerability class: Unrestricted File Upload
EPSS: 0.003 (21.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L.
Affected products
- Aveva Pi Integrator — versions 0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-54460?
- CVE-2025-54460 is a high-severity vulnerability in Aveva Pi Integrator, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 7.1/10. Published 2025-08-21.
- How severe is CVE-2025-54460?
- High severity. CVSS v3 base score is 7.1 out of 10.