{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-20T20:07:33.576","vulnerabilities":[{"cve":{"id":"CVE-2025-62487","sourceIdentifier":"cve-coordination@palantir.com","published":"2026-01-09T22:16:00.260","lastModified":"2026-04-15T00:35:42.020","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"On October 1, 2025, Palantir discovered that images uploaded through the Dossier front-end app were not being marked correctly with the proper security levels. The regression was traced back to a change in May 2025, which was meant to allow file uploads to be shared among different artifacts (e.g. other dossiers and presentations).\n\n\nOn deployments configured with CBAC, the front-end would present a security picker dialog to set the security level on the uploads, thereby mitigating the issue.\n\n\nOn deployments without a CBAC configuration, no security picker dialog appears, leading to a security level of CUSTOM with no markings or datasets selected. The resulting markings and groups for the file uploads thus will be only those added by the default authorization rules defined in the Auth Chooser configuration. On most environments, it is expected that the default authorization rules only add the Everyone group."},{"lang":"es","value":"El 1 de octubre de 2025, Palantir descubrió que las imágenes subidas a través de la aplicación de interfaz (front-end) de Dossier no estaban siendo marcadas correctamente con los niveles de seguridad adecuados. La regresión se rastreó hasta un cambio en mayo de 2025, que tenía como objetivo permitir que las subidas de archivos se compartieran entre diferentes artefactos (por ejemplo, otros dosieres y presentaciones).\n\nEn despliegues configurados con CBAC, la interfaz (front-end) presentaría un diálogo de selección de seguridad para establecer el nivel de seguridad en las subidas, mitigando así el problema.\n\nEn despliegues sin una configuración de CBAC, no aparece ningún diálogo de selección de seguridad, lo que lleva a un nivel de seguridad de CUSTOM sin marcas ni conjuntos de datos seleccionados. Las marcas y grupos resultantes para las subidas de archivos, por lo tanto, serán solo aquellos añadidos por las reglas de autorización predeterminadas definidas en la configuración de Auth Chooser. En la mayoría de los entornos, se espera que las reglas de autorización predeterminadas solo añadan el grupo Todos."}],"metrics":{"cvssMetricV31":[{"source":"cve-coordination@palantir.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","baseScore":3.5,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":1.4}]},"weaknesses":[{"source":"cve-coordination@palantir.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://palantir.safebase.us/?tcuUid=c91a1b4f-72e7-4959-9e2d-3a341e5c7a1f","source":"cve-coordination@palantir.com"}]}}]}