PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-23410 GMOD CVE debrief

CVE-2025-23410 is a critical path-traversal weakness in GMOD Apollo’s web upload flow for organism or sequence data. According to CISA’s advisory, Apollo versions before 2.8.0 unzip and inspect supported archive types without checking for traversal in archive paths, so the safest response is to upgrade to 2.8.0 as soon as possible.

Vendor
GMOD
Product
Apollo
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2025-03-04
Original CVE updated
2025-03-04
Advisory published
2025-03-04
Advisory updated
2025-03-04

Who should care

Apollo administrators, operators, and teams that allow users to upload organism or sequence archives through the web interface should treat this as urgent. Security teams responsible for ICS or laboratory data workflows should also review whether any exposed upload endpoints or automation jobs could accept attacker-controlled archives.

Technical summary

The supplied CSAF advisory states that GMOD Apollo <2.8.0 processes uploaded organism or sequence archives in the web interface by unzipping and inspecting their contents, but does not validate archive entry paths for traversal. That creates a path-traversal condition during archive extraction, and the advisory assigns CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating a network-reachable issue with high impact to confidentiality, integrity, and availability.

Defensive priority

Immediate / critical priority. Patch to Apollo 2.8.0 first, then verify upload handling and extraction controls.

Recommended defensive actions

  • Upgrade GMOD Apollo to version 2.8.0 or later using the vendor remediation in the advisory.
  • Restrict upload functionality to trusted users and reduce exposure of archive-upload endpoints where possible.
  • Validate archive extraction paths and enforce safe extraction controls so uploaded files cannot escape the intended directory.
  • Review recent and historical uploads for unexpected file placement or other signs of unsafe archive handling.
  • Apply CISA ICS recommended practices and defense-in-depth guidance for systems that process uploaded files.

Evidence notes

All material here is drawn from the supplied CISA CSAF advisory and its references. The advisory identifies affected products as GMOD Apollo <2.8.0, states that the web upload flow unzips and inspects archives without path-traversal checks, and recommends updating to the newest version 2.8.0. The provided CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, supporting the critical severity rating. No KEV listing is included in the supplied enrichment.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-23410 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-23410

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-23410 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-23410

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-063-07.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-07

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.