CVE-2025-10096 is a Server-Side Request Forgery (SSRF) vulnerability identified in SimStudioAI's product 'sim' version 1.0.0 and earlier. The vulnerability exists in an unspecified function within the file apps/sim/app/api/files/parse/route.ts, where manipulation of the 'filePath' argument can lead to SSRF. SSRF vulnerabilities allow an attacker to make the server perform unauthorized requests to internal or external resources, potentially bypassing firewall restrictions or accessing sensitive internal services. This particular vulnerability can be exploited remotely without user interaction or authentication, as indicated by the CVSS vector (AV:N/AC:L/AT:N/UI:N/PR:L). The CVSS 4.0 base score is 5.3, categorized as medium severity, reflecting limited impact on confidentiality, integrity, and availability, and requiring low privileges. The vulnerability has been publicly disclosed, and a patch identified by commit 3424a338b763115f0269b209e777608e4cd31785 is available to remediate the issue. Although no known exploits are currently reported in the wild, the public disclosure increases the risk of exploitation. The vulnerability does not require user interaction and has a low complexity of attack, making it a concern for organizations using this software. The SSRF could be leveraged to access internal services, potentially leading to information disclosure or further exploitation depending on the internal network configuration and the privileges of the vulnerable application.

For European organizations using SimStudioAI 'sim' version 1.0.0 or earlier, this SSRF vulnerability poses a moderate risk. Exploitation could allow attackers to access internal network resources that are otherwise protected, potentially exposing sensitive data or internal APIs. This could lead to lateral movement within the network or reconnaissance activities that precede more severe attacks. Given the medium severity, direct disruption or data manipulation is less likely but not impossible if combined with other vulnerabilities. Organizations in sectors with high reliance on AI simulation tools, such as research institutions, engineering firms, or technology companies, may face increased risk. The ability to exploit remotely without authentication increases the threat surface, especially for internet-facing deployments. The impact is heightened if the vulnerable service has access to critical internal systems or sensitive data. However, the lack of known active exploitation reduces immediate risk, though the public disclosure necessitates prompt remediation to prevent future attacks.

European organizations should prioritize applying the official patch identified by commit 3424a338b763115f0269b209e777608e4cd31785 to eliminate the SSRF vulnerability. If immediate patching is not feasible, organizations should implement network-level controls to restrict outbound HTTP/HTTPS requests from the SimStudioAI 'sim' application server, limiting the ability to reach internal or sensitive endpoints. Employing web application firewalls (WAFs) with rules to detect and block SSRF patterns targeting the 'filePath' parameter can provide temporary protection. Additionally, input validation and sanitization should be enhanced to restrict the 'filePath' parameter to only allow legitimate, expected values or file locations. Monitoring and logging outbound requests from the application server can help detect suspicious activity indicative of exploitation attempts. Finally, conducting a thorough review of internal network segmentation and access controls can reduce the potential impact if SSRF is exploited.