CVE-2025-46559: Misskey

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

Misskey is an open source, federated social media platform. Starting in version 12.31.0 and prior to version 2025.4.1, missing validation in `Mk:api` allows malicious AiScript code to access additional endpoints that it isn't designed to have access to. The missing validation allows malicious AiScript code to prefix a URL with `../` to step out of the `/api` directory, thereby being able to make requests to other endpoints, such as `/files`, `/url`, and `/proxy`. Version 2025.4.1 fixes the issue.

Affected products

• Misskey Misskey: from 12.31.0, before 2025.4.1 (fixed in 2025.4.1)

Published 2025-05-05. Last modified 2026-06-17.