CVE-2025-55251 is an unrestricted file upload weakness in HCL AION, scored CVSS 3.1 (low) in the NVD record. The score is low because exploitation needs local access, high privileges and user interaction. HCL documents the correction in a knowledge base article, so confirm the fixed build there and apply it.
What's affected
The NVD record names HCL AION as the affected product. It does not list version ranges, and the CVSS vector is CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L, which means local access, high privileges and a user action are all needed.
The companion record CVE-2025-55252 covers a weak password policy in HCL AION version 2 and was published on the same day from the same article. The HCL support portal did not return article text when I fetched it, so this guide relies on the NVD record. Read the article itself for the fixed version.
How to check if you're exposed
HCL publishes the affected and fixed builds for AION in its knowledge base article, and that article is the authority. I could not read its text when preparing this guide, so I will not state a fixed version here.
- Find the build you run. The admin or about page of the product usually shows it, and so does your deployment record.
- Open the HCL article listed under Sources and compare your build with its list of affected and fixed builds.
- If the article lists a fix and you are behind it, you are exposed to the issue described here. If your build is not named, ask HCL support to confirm in writing.
Because the weakness is about what the application accepts as an upload, a quick review of your own configuration helps too. List who holds upload rights in AION and whether uploaded files are stored anywhere a web server could run them.
What to do now
- Identify every AION instance, including test and staging copies.
- Read the HCL article and note the corrected build.
- Schedule the update through your normal change process. Severity is low, so this can follow your regular patch cycle unless AION is exposed to many users.
- Review who has high privileges in AION and remove accounts that no longer need them.
- Record the new version in your asset inventory so the next review is quick.
Why it matters
The weakness class is CWE-434, unrestricted upload of a file with a dangerous type. An application that accepts files without checking type, name and destination can end up storing something that later runs. The record says this can lead to code execution or system compromise.
The CVSS vector tempers that. An attacker needs a privileged local position and a user to act, so the realistic risk is for shared systems or insider misuse. That is a good reason to patch on schedule and also to keep privileged accounts few.
Quick check
Is CVE-2025-55251 exploited in the wild?
The record's KEV flag is false, and I found no advisory text saying it is exploited. Treat it as a patch-on-schedule item.
Sources
Last reviewed: 19 October 2026.
