CVE-2025-64712 in Unstructured.io Puts Amazon, Google, and Tech Giants at Risk of Remote Code Execution
## Critical Vulnerability in Unstructured.io's ETL Library
Critical Vulnerability in Unstructured.io's ETL Library
A critical vulnerability identified as CVE-2025-64712 (CVSS 9.8) has been discovered in Unstructured.io's "unstructured" ETL library. This flaw allows for arbitrary file writes, potentially leading to remote code execution (RCE) on systems handling untrusted documents.
Unstructured.io's ETL library is extensively used to convert various business files into AI-ready text and embeddings. The library's widespread deployment across numerous Fortune 1000 companies raises significant concerns for organizations utilizing it in their production pipelines.
Impact on Unstructured Data Processing
The unstructured data, including PDFs, emails, Word documents, slide decks, and images, constitutes approximately 80%–90% of enterprise data. This data is challenging to search and analyze using traditional systems.
Tools like Unstructured.io help in extracting text through methods such as OCR for PDFs and speech-to-text for audio files. This information is then stored in a searchable backend, like a vector database, enabling AI systems to quickly retrieve relevant data.
CVE ID CVSS Score Description
A critical vulnerability identified as CVE-2025-64712 (CVSS 9.8) has been discovered in Unstructured.io's "unstructured" ETL library.
CVE-2025-64712 9.8 Path traversal leading to arbitrary file write, potentially enabling RCE on hosts running the unstructured library
The vulnerability arises from a path traversal bug in the code processing Microsoft Outlook email message files (.msg). When handling a .msg file with attachments, the library writes each attachment to a temporary directory before extracting text. The vulnerability occurs due to unsafe concatenation of the temporary directory path with the filename, allowing attackers to manipulate the file path.
An attacker could exploit this by using traversal sequences, such as ../../ , to write files outside the intended directory. For instance, a crafted attachment name like ../../root/.ssh/authorized_keys could overwrite SSH authorized keys, granting persistent unauthorized access.
To mitigate this risk, it is recommended to:
Isolate file processing to containers or virtual machines. Run processes as a non-root user. Implement path normalization and filename allowlists to prevent traversal. Avoid writing attacker-influenced filenames to disk.
Based on reporting by GBHackers.