CVE-2025-11919

Name of the Vulnerable Software and Affected Versions Wolfram Cloud (affected versions not specified)

Description An issue exists where the default JVM can access files and directories under /tmp/, including the $TemporaryDirectory of other users on the same cloud instance located at /tmp/UserTemporaryFiles/. During JVM startup, the -init file for initialization is placed in this vulnerable directory. An attacker with access to the shared /tmp/ space can preemptively create or replace .jar files or directories via the -init file that the victim JVM resolves first in its classpath. By placing a malicious version of a common library, such as commons-io, in a location prioritized in the classpath, an attacker can force the JVM to load the malicious class during startup, leading to remote code execution and potential compromise of the cloud execution infrastructure.