CVE-2025-7114 | SimStudioAI sim up to 37786d371e17d35e0764e1b5cd519d873d90d97b Session route.ts POST Request missing authentication

A vulnerability was found in SimStudioAI sim up to 37786d371e17d35e0764e1b5cd519d873d90d97b. It has been declared as critical. Affected by this vulnerability is the function POST of the file apps/sim/app/api/files/upload/route.ts of the component Session Handler. The manipulation of the argument Request leads to missing authentication.

This vulnerability is known as CVE-2025-7114. The attack can be launched remotely. Furthermore, there is an exploit available.

The vendor was contacted early about this disclosure but did not respond in any way.