CVE-2025-60722: 
NixOS vulnerability analysis and mitigation

CVE-2025-60722 is a path traversal vulnerability (CWE-22) in Microsoft OneDrive for Android that allows an authenticated attacker with low-privilege access to elevate privileges over a network. It affects all OneDrive for Android versions prior to 7.42. The vulnerability was published on November 11, 2025, as part of Microsoft's November 2025 Patch Tuesday release. It carries a CVSS v3.1 base score of 6.5 (Medium) (Microsoft MSRC).

The vulnerability stems from improper limitation of a pathname to a restricted directory (CWE-22), where the OneDrive for Android application fails to adequately validate or sanitize file path inputs, allowing traversal outside of intended directory boundaries. An authorized attacker with low privileges can craft network requests containing path traversal sequences (e.g., ../) to access or modify files outside the application's restricted directory scope. Exploitation requires no user interaction and has low attack complexity, but does require the attacker to already be authenticated to the application. Related attack patterns include CAPEC-126 (Path Traversal), CAPEC-64 (Using Slashes and URL Encoding to Bypass Validation), and CAPEC-76 (Manipulating Web Input to File System Calls) (Microsoft MSRC).

Successful exploitation allows an authenticated low-privilege attacker to elevate their privileges within the OneDrive for Android application, potentially enabling unauthorized modification of files that would otherwise be inaccessible. The primary impact is to data integrity (rated High), with no direct confidentiality or availability impact per the CVSS scoring. This could allow an attacker to tamper with files stored or managed by OneDrive on the affected Android device, potentially compromising the integrity of cloud-synced data (Microsoft MSRC).

There is no public proof-of-concept exploit code available, and no evidence of in-the-wild exploitation has been reported as of the time of disclosure. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.067%, indicating a low probability of exploitation in the near term (Microsoft MSRC).

Microsoft has released a patch addressing this vulnerability in OneDrive for Android version 7.42 and later. Users and administrators should update the OneDrive for Android application to version 7.42 or higher via the Google Play Store as the primary remediation. As additional precautions, organizations should restrict network access to the OneDrive application where possible, monitor for unusual file modification activity, and review user privilege assignments within the application (Microsoft MSRC).

CVE-2025-60722 was covered as part of broader November 2025 Patch Tuesday roundups by several security outlets. Sophos noted the November Patch Tuesday addressed routine maintenance-level issues, and Zero Day Initiative published a security update review covering the full release (Sophos News, ZDI Blog). BleepingComputer and other outlets reported on the broader Patch Tuesday release of 63 vulnerabilities, with this CVE receiving minimal individual attention given its medium severity and lack of active exploitation (BleepingComputer).