Critical severity · published Jan 19, 2026
CVE-2025-55251
HCL AION is affected by an Unrestricted File Upload vulnerability
9.8
CVSS
0.2%
EPSS
No
On KEV
Description
HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthorized code execution or system compromise.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
AION · HCL Software
2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-55251
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-55251
Permissions Required
https://support.hcl-software.com/kb_view.do?sys_kb_id=4b92474633de7ad4159a05273e5c7b4b&searchTerm=kb0127995#
More from AION
9.8
CVE-2025-55252
HCL AION is affected by a Weak Password Policy vulnerability
9.8
CVE-2025-52660
HCL AION is affected by an Host Header Injection vulnerability
7.5
CVE-2025-52659
HCL AION is affected by a Cacheable HTTP Response vulnerability
5.6
CVE-2025-62314
HCL AION is affected by multiple security vulnerabilities.
5.3
CVE-2025-55250
HCL AION is affected by a Technical Error Disclosure vulnerability