# Security Advisories

Please report vulnerabilities to Devolutions. To learn about our vulnerability response policy, [click here](https://ironmansoftware.com/vulnerability-response-policy/).

## Devolutions Advisories

Security advisories after October 2025 can be found on the [Devolutions Advisories page](https://devolutions.net/security/advisories/).

## Past Advisories

### CVE-2025-54552 - 7/25/2025 - Information disclosure

#### Description

The PowerShell Universal Live App documentation lists all variables to authenticated users. The connection string variable is included in this list. Depending on database configuration, this can include plaintext credentials.

Affected Versions: v4.5.4 and earlier, v5.6.0 and earlier

CVSS v4.0 Score: 8.7 / High: [AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C/CR:X/IR:X/AR:X/MAV:N/MAC:L/MPR:L/MUI:R/MS:C/MC:H/MI:H/MA:H](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C/CR:X/IR:X/AR:X/MAV:N/MAC:L/MPR:L/MUI:R/MS:C/MC:H/MI:H/MA:H\&version=3.1)

#### Workaround

In addition to upgrading to a patched version, you can also edit the installation media to remove the variable.

Edit the file Docs\variables.ps1.

```powershell
New-UDPage -Name 'Variables' -Icon (New-UDIcon -Icon 'SquareRootVariable') -Content {
    $Variables = Get-Variable | Where-Object Name -ne PSUConnectionString | ForEach-Object {
        [PSCustomObject]@{
            Name        = $_.Name
            Value       = if ($_.Value -eq $null) { "$null" } else { $_.Value.ToString() }
            Description = $_.Description
        }
    }
    New-UDTable -Title 'Variables' -Data $Variables -Columns @(
        New-UDTableColumn -Property Name -Title 'Name'
        New-UDTableColumn -Property Value -Title 'Value'
        New-UDTableColumn -Property Description -Title 'Description'
    ) -ShowPagination -Dense -PageSize 10
}
```

### CVE-TBD - 2/18/2025 - Incorrect Access Controls

#### Description

Due to an authorization issue with the PowerShell Universal v5.3.x's gRPC service registration, a remote attacker can access the server using the Universal PowerShell module without authentication.

#### CVSS v4.0 Score: 9.8 High

### CVE-2025-26792 - 1/29/2025 - Information disclosure

#### Description

Version 4.5.x and 5.x.x are vulnerable to an information disclosure through directory traversal when using PowerShell Universal published folders. Systems that do not have this feature configured, are not affected. If authenticated published folders are configured, the attacker will need to be authenticated.

#### CVSS v4.0 Score: 5.4 / Medium

This exploit allows an attacker to expose information of the affected system, depending on system configuration.

### CVE-2024-50616 - 10/17/2024 - Privilege escalation and information disclosure

#### Description

Version 5.0.0 through 5.0.11 are vulnerable to an exploit that allows an authenticated attacker to elevate their privileges and view job information.

#### CVSS v4.0 Score: 7.4 / High

This exploit allows an authenticated attacker to take control of the platform via a vulnerability in the admin console.

###

###


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.powershelluniversal.com/changelogs/cves.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.