CVE-2025-46653

A flaw was found in Formidable (node-formidable) related to its pseudo-random number generator (PRNG). The package uses a weak method to generate random filenames for uploaded files, making it possible for attackers to predict filenames under certain conditions. This vulnerability could allow an attacker to guess and access uploaded files, potentially leading to data exposure or malicious file manipulation.

Red Hat assigned a lower CVSS score because successful exploitation requires predicting filenames generated by a non-cryptographic PRNG under specific timing conditions, which significantly increases attack complexity. Additionally, the practical impact is limited to a potential low integrity issue (e.g., file overwrite) with no demonstrated confidentiality or availability impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.