Microsoft Security Advisory CVE-2025-30399 | .NET Remote Code Vulnerability
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0 and .NET 9.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
An attacker could exploit this vulnerability by placing files in particular locations, leading to unintended code execution.
The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
1
cwe_id
937
name
OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description
Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.
2
cwe_id
1035
name
OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description
Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
3
cwe_id
427
name
Uncontrolled Search Path Element
description
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.