CVE-2025-61165: file upload flaw enables RCE

CISO Take

Cohere North AI v1.1.5 exposes a file upload endpoint (/v1/my_drive/batch_upload) that fails to validate uploaded content, allowing an attacker to plant a crafted file that gets executed on the server — a classic arbitrary file upload leading to remote code execution. There is no CVSS score, no EPSS data, no CISA KEV listing, and no public exploit or Nuclei template yet, so this hasn't been weaponized at scale; but file-upload-to-RCE bugs are typically trivial to exploit once a working PoC circulates, and the only public reference so far is a researcher write-up on GitHub, not a vendor advisory. Because North AI is Cohere's enterprise agentic platform, successful exploitation would hand an attacker code execution on the host running document ingestion and agent workflows, with potential access to connected drives and downstream tools. Until Cohere ships a fix, restrict or firewall the batch_upload endpoint, enforce independent server-side file-type/content validation in front of it, and monitor for anomalous uploads or unexpected process spawning on the North AI host.

Sources:NVDcohere.comATLAS

What is the risk?

No CVSS vector has been assigned, but the vulnerability class — unauthenticated or low-friction arbitrary file upload leading to code execution — is historically rated critical (CVSS 9.0+) once details are confirmed. Exploitability is likely low-complexity: file upload RCE chains typically require no special AI/ML expertise, just the ability to reach the endpoint and craft a file the server will execute. Exposure risk is currently unclear (no confirmation of authentication requirements), and there is no evidence of active exploitation, scanner coverage, or KEV inclusion, so treat this as a high-severity but not yet actively-exploited issue pending vendor confirmation.

How does the attack unfold?

Initial Access

Attacker reaches the /v1/my_drive/batch_upload endpoint of a Cohere North AI v1.1.5 deployment.

AML.T0049

Malicious Upload & Execution

Attacker uploads a crafted file that bypasses validation and is executed by the server.

AML.T0050

Foothold Established

Attacker uses the code execution to open a reverse shell or persistent access channel on the host.

AML.T0072

Impact

Attacker accesses ingested documents, agent configuration, and connected tools/drives on the compromised North AI host.

AML.T0037

Initial Access

Attacker reaches the /v1/my_drive/batch_upload endpoint of a Cohere North AI v1.1.5 deployment.

AML.T0049

Malicious Upload & Execution

Attacker uploads a crafted file that bypasses validation and is executed by the server.

AML.T0050

Foothold Established

Attacker uses the code execution to open a reverse shell or persistent access channel on the host.

AML.T0072

Impact

Attacker accesses ingested documents, agent configuration, and connected tools/drives on the compromised North AI host.

AML.T0037

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 39% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Check with Cohere for a patched North AI release beyond v1.1.5 and apply it as soon as available. 2) Until patched, restrict network access to /v1/my_drive/batch_upload to trusted users/IP ranges and require strong authentication. 3) Deploy an independent server-side control (reverse proxy/WAF) that validates file type, extension, and content-magic-bytes regardless of what the application accepts. 4) Store uploaded files outside any web-executable path and disable execute permissions on the upload directory. 5) Monitor logs and EDR on the North AI host for unexpected file writes, new scripts, or process execution following uploads to this endpoint.

What does CISA's SSVC say?

DecisionAttend

Exploitationpoc

AutomatableYes

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionAgentRAGAML.T0037- Data from Local System AML.T0049- Exploit Public-Facing Application AML.T0072- Reverse Shell

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, Robustness and Cybersecurity

ISO 42001

Annex A.6.2-AI System Security Controls

NIST AI RMF

MANAGE 4.1-Third-Party AI System Risk Management

Frequently Asked Questions

What is CVE-2025-61165?

Cohere North AI v1.1.5 exposes a file upload endpoint (/v1/my_drive/batch_upload) that fails to validate uploaded content, allowing an attacker to plant a crafted file that gets executed on the server — a classic arbitrary file upload leading to remote code execution. There is no CVSS score, no EPSS data, no CISA KEV listing, and no public exploit or Nuclei template yet, so this hasn't been weaponized at scale; but file-upload-to-RCE bugs are typically trivial to exploit once a working PoC circulates, and the only public reference so far is a researcher write-up on GitHub, not a vendor advisory. Because North AI is Cohere's enterprise agentic platform, successful exploitation would hand an attacker code execution on the host running document ingestion and agent workflows, with potential access to connected drives and downstream tools. Until Cohere ships a fix, restrict or firewall the batch_upload endpoint, enforce independent server-side file-type/content validation in front of it, and monitor for anomalous uploads or unexpected process spawning on the North AI host.

Is CVE-2025-61165 actively exploited?

No confirmed active exploitation of CVE-2025-61165 has been reported, but organizations should still patch proactively.

How to fix CVE-2025-61165?

1) Check with Cohere for a patched North AI release beyond v1.1.5 and apply it as soon as available. 2) Until patched, restrict network access to /v1/my_drive/batch_upload to trusted users/IP ranges and require strong authentication. 3) Deploy an independent server-side control (reverse proxy/WAF) that validates file type, extension, and content-magic-bytes regardless of what the application accepts. 4) Store uploaded files outside any web-executable path and disable execute permissions on the upload directory. 5) Monitor logs and EDR on the North AI host for unexpected file writes, new scripts, or process execution following uploads to this endpoint.

What systems are affected by CVE-2025-61165?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines.

What is the CVSS score for CVE-2025-61165?

CVE-2025-61165 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.45%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelines

MITRE ATLAS Techniques

AML.T0037Data from Local System

AML.T0049Exploit Public-Facing Application

AML.T0072Reverse Shell

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Annex A.6.2

NIST AI RMF: MANAGE 4.1

What are the technical details?

Original Advisory

An arbitrary file upload vulnerability in the /v1/my_drive/batch_upload component of cohere North AI v1.1.5 allows attackers to exeute arbitrary code via uploading a crafted file.

Exploitation Scenario

An attacker with access to the North AI web interface or API uploads a file to /v1/my_drive/batch_upload disguised as a legitimate document but crafted to be interpreted and executed by the underlying server (e.g., a script with a spoofed extension or embedded executable content). Because the endpoint doesn't properly validate the upload, the server processes and runs the file, giving the attacker a foothold to establish a reverse shell, pivot to the AI agent's connected drives and tool integrations, and exfiltrate ingested enterprise documents or credentials.