A critical vulnerability (CVE-2025-64712) in Unstructured.io, an ETL library powering AI data processing for 87% of Fortune 1000 companies, including Amazon, Google, and Bank of America.
Assigned a CVSS score of 9.8, this path traversal flaw enables arbitrary file writes and potentially remote code execution on systems running the library.
The issue stems from insecure handling of Microsoft Outlook .msg attachments, allowing attackers to overwrite critical files like SSH authorized_keys.
Unstructured.io transforms unstructured data such as PDFs, emails, and images, which comprise 80-90% of enterprise data, into AI-ready formats.
Its open-source library on GitHub processes documents via extraction, chunking, and embedding for vector databases.
Enterprises use it alongside managed SaaS APIs and a no-code platform integrating with S3, Google Drive, OneDrive, and Salesforce.
Popular frameworks like LlamaIndex and LangChain wrap it, amplifying the blast radius across millions of deployments, including OpenWebUI.
| CVE ID | CVSS Score | Description | Affected Versions | Patch Status |
|---|---|---|---|---|
| CVE-2025-64712 | 9.8 (Critical) | Path traversal in partition_msg() via .msg attachments allows arbitrary file write by using attacker-controlled filenames (e.g., ../../root/.ssh/authorized_keys), leading to RCE via webshells, cron jobs, or startup script injection. Attack vector: Network (low complexity, no privileges/impact required). | All versions prior to latest commit (check GitHub) | Patch available; update immediately |
The flaw hides in the partition_msg function, which is invoked MsgPartitioner.iter_message_elements to handle email elements.
For attachments, AttachmentPartitioner.iter_elements stores them in /tmp/ by blindly concatenating the temp directory with self._attachment_file_name the original, unvalidated filename from the .msg file.
According to Cyera, an attacker crafts an attachment named ../../etc/passwd or similar, writing malicious content anywhere on the filesystem. This escalates to full server compromise, enabling data exfiltration, credential theft, or lateral movement.
With over 4 million monthly downloads and nested dependencies in ~100K GitHub files via LangChain, this supply chain risk defies easy tracking.
Cloud giants reference Unstructured in Azure, AWS, and GCP docs, embedding it in production AI pipelines.
Organizations should audit dependencies, upgrade the library from GitHub, and scan for .msg inputs in untrusted sources.
CISA and vendors urge immediate patching to avert RCE in enterprise environments.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google
.webp?fit=1600,900&ssl=1&description=Assigned a CVSS score of 9.8, this path traversal flaw enables arbitrary file writes and potentially remote code execution on systems running the library.){kind=link}