CVE-2025-61165: file upload flaw enables RCE

CISO Take

Cohere North AI v1.1.5 exposes a file upload endpoint (/v1/my_drive/batch_upload) that fails to validate uploaded content, allowing an attacker to plant a crafted file that gets executed on the server — a classic arbitrary file upload leading to remote code execution. There is no CVSS score, no EPSS data, no CISA KEV listing, and no public exploit or Nuclei template yet, so this hasn't been weaponized at scale; but file-upload-to-RCE bugs are typically trivial to exploit once a working PoC circulates, and the only public reference so far is a researcher write-up on GitHub, not a vendor advisory. Because North AI is Cohere's enterprise agentic platform, successful exploitation would hand an attacker code execution on the host running document ingestion and agent workflows, with potential access to connected drives and downstream tools. Until Cohere ships a fix, restrict or firewall the batch_upload endpoint, enforce independent server-side file-type/content validation in front of it, and monitor for anomalous uploads or unexpected process spawning on the North AI host.

Sources: NVD cohere.com ATLAS

What is the risk?

No CVSS vector has been assigned, but the vulnerability class — unauthenticated or low-friction arbitrary file upload leading to code execution — is historically rated critical (CVSS 9.0+) once details are confirmed. Exploitability is likely low-complexity: file upload RCE chains typically require no special AI/ML expertise, just the ability to reach the endpoint and craft a file the server will execute. Exposure risk is currently unclear (no confirmation of authentication requirements), and there is no evidence of active exploitation, scanner coverage, or KEV inclusion, so treat this as a high-severity but not yet actively-exploited issue pending vendor confirmation.

How does the attack unfold?

Initial Access

Attacker reaches the /v1/my_drive/batch_upload endpoint of a Cohere North AI v1.1.5 deployment.

AML.T0049

Malicious Upload & Execution

Attacker uploads a crafted file that bypasses validation and is executed by the server.

AML.T0050

Foothold Established

Attacker uses the code execution to open a reverse shell or persistent access channel on the host.

AML.T0072

Impact

Attacker accesses ingested documents, agent configuration, and connected tools/drives on the compromised North AI host.

AML.T0037

Initial Access

Attacker reaches the /v1/my_drive/batch_upload endpoint of a Cohere North AI v1.1.5 deployment.

AML.T0049

Malicious Upload & Execution

Attacker uploads a crafted file that bypasses validation and is executed by the server.

AML.T0050

Foothold Established

Attacker uses the code execution to open a reverse shell or persistent access channel on the host.

AML.T0072

Impact

Attacker accesses ingested documents, agent configuration, and connected tools/drives on the compromised North AI host.

AML.T0037

How severe is it?

CVSS 3.1

N/A

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

1 step

1) Check with Cohere for a patched North AI release beyond v1.1.5 and apply it as soon as available. 2) Until patched, restrict network access to /v1/my_drive/batch_upload to trusted users/IP ranges and require strong authentication. 3) Deploy an independent server-side control (reverse proxy/WAF) that validates file type, extension, and content-magic-bytes regardless of what the application accepts. 4) Store uploaded files outside any web-executable path and disable execute permissions on the upload directory. 5) Monitor logs and EDR on the North AI host for unexpected file writes, new scripts, or process execution following uploads to this endpoint.

How is it classified?

Code Execution Agent RAG AML.T0037 - Data from Local System AML.T0049 - Exploit Public-Facing Application AML.T0072 - Reverse Shell

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

Annex A.6.2 - AI System Security Controls

NIST AI RMF

MANAGE 4.1 - Third-Party AI System Risk Management

Frequently Asked Questions

What is CVE-2025-61165?

Cohere North AI v1.1.5 exposes a file upload endpoint (/v1/my_drive/batch_upload) that fails to validate uploaded content, allowing an attacker to plant a crafted file that gets executed on the server — a classic arbitrary file upload leading to remote code execution. There is no CVSS score, no EPSS data, no CISA KEV listing, and no public exploit or Nuclei template yet, so this hasn't been weaponized at scale; but file-upload-to-RCE bugs are typically trivial to exploit once a working PoC circulates, and the only public reference so far is a researcher write-up on GitHub, not a vendor advisory. Because North AI is Cohere's enterprise agentic platform, successful exploitation would hand an attacker code execution on the host running document ingestion and agent workflows, with potential access to connected drives and downstream tools. Until Cohere ships a fix, restrict or firewall the batch_upload endpoint, enforce independent server-side file-type/content validation in front of it, and monitor for anomalous uploads or unexpected process spawning on the North AI host.

Is CVE-2025-61165 actively exploited?

No confirmed active exploitation of CVE-2025-61165 has been reported, but organizations should still patch proactively.

How to fix CVE-2025-61165?

1) Check with Cohere for a patched North AI release beyond v1.1.5 and apply it as soon as available. 2) Until patched, restrict network access to /v1/my_drive/batch_upload to trusted users/IP ranges and require strong authentication. 3) Deploy an independent server-side control (reverse proxy/WAF) that validates file type, extension, and content-magic-bytes regardless of what the application accepts. 4) Store uploaded files outside any web-executable path and disable execute permissions on the upload directory. 5) Monitor logs and EDR on the North AI host for unexpected file writes, new scripts, or process execution following uploads to this endpoint.

What systems are affected by CVE-2025-61165?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines.

What is the CVSS score for CVE-2025-61165?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelines

MITRE ATLAS Techniques

AML.T0037 Data from Local System

AML.T0049 Exploit Public-Facing Application

AML.T0072 Reverse Shell

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Annex A.6.2

NIST AI RMF: MANAGE 4.1

What are the technical details?

Original Advisory

An arbitrary file upload vulnerability in the /v1/my_drive/batch_upload component of cohere North AI v1.1.5 allows attackers to exeute arbitrary code via uploading a crafted file.

Exploitation Scenario

An attacker with access to the North AI web interface or API uploads a file to /v1/my_drive/batch_upload disguised as a legitimate document but crafted to be interpreted and executed by the underlying server (e.g., a script with a spoofed extension or embedded executable content). Because the endpoint doesn't properly validate the upload, the server processes and runs the file, giving the attacker a foothold to establish a reverse shell, pivot to the AI agent's connected drives and tool integrations, and exfiltrate ingested enterprise documents or credentials.