Description
该漏洞影响 MPDV Mikrolab GmbH 的 HYDRA X、MIP 2 和 FEDRA 2（维护包36，服务包8及以前版本）。攻击者可通过未授权访问，利用 $SCHEMAS$ 资源的 Filename 参数路径遍历，读取任意 Windows 操作系统文件，造成本地文件泄露。漏洞根源为对参数校验不严，仅需要本地访问权限。
MPDV Mikrolab GmbH HYDRA X, MIP 2, FEDRA 2 /hx/resources/public/$SCHEMAS$ 文件读取漏洞（CVE-2025-12055）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-12055
https://sec-consult.com/vulnerability-lab/advisory/unauthenticated-local-file-disclosure-in-mpdv-mikrolab-mip-2-fedra-2-hydra-x-manufacturing-execution-system/
https://seclists.org/fulldisclosure/2025/Oct/28
https://github.com/advisories/GHSA-mphm-qj4m-rgxx
https://stemcellsclinical.com/vulnerability?page=4
https://access.redhat.com/security/cve/cve-2025-12055
https://feedly.com/cve/CVE-2025-12055
https://socdefenders.ai/cves/CVE-2025-12055
https://devhub.checkmarx.com/cve-details/cve-2025-12055/