# CVE-2025-47221: An arbitrary file write was found in Keyfactor SignServer versions prior to 7.3.2. The properties…

Source: https://junglewise.ai/threats/cve-2025-47221-an-arbitrary-file-write-was-found-in-keyfactor-signserver  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-13  
License: CC BY 4.0 with a link back

CVE-2025-47221 · Severity: medium · CVSS 5.3 · Published 2025-11-13

An arbitrary file write was found in Keyfactor SignServer versions prior to 7.3.2. The properties ARCHIVETODISK_FILENAME-PATTERN, ARCHIVETODISK_PATH_BASE, ARCHIVETODISK_PATH_PATTERN can be set to any path, even ones that will point to files that already exist. This vulnerability gives a user with admin access the possibility to write files in arbitrary directories in the server file system and potentially overwrite files accessible by the local user JBoss.

Technologies: [Keyfactor SignServer](https://junglewise.ai/threats/technologies/signserver). Vendors: [Keyfactor](https://junglewise.ai/threats/vendors/keyfactor).

## Quick answers

**Is CVE-2025-47221 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-47221 being exploited in the wild.

**How severe is CVE-2025-47221?** Medium severity, with a CVSS score of 5.3, published 13 November 2025.

**Which products and versions are affected?** Keyfactor SignServer. The advisory does not name versions.

**Is there a fix for CVE-2025-47221?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-47221?** Check whether you run Keyfactor SignServer. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Keyfactor SignServer

## Related threats

- [Keyfactor SignServer local file enumeration via unrestricted properties](https://junglewise.ai/threats/cve-2026-25827-keyfactor-signserver-local-file-enumeration-via-unrestricted)
- [Keyfactor SignServer file content exposure in PKCS11CryptoToken](https://junglewise.ai/threats/cve-2026-25826-keyfactor-signserver-file-content-exposure-in-pkcs11cryptotoken)
- [Keyfactor SignServer arbitrary file write in SignerStatusReportWorker](https://junglewise.ai/threats/cve-2026-25825-keyfactor-signserver-arbitrary-file-write-in)
- [An error in the SignServer container startup logic was found in Keyfactor SignServer versions prior to 7.2. The Admin…](https://junglewise.ai/threats/cve-2025-26787-an-error-in-the-signserver-container-startup-logic-was-found-in)
- [A class name enumeration was found in Keyfactor SignServer versions prior to 7.3.2. Setting any chosen class name to…](https://junglewise.ai/threats/cve-2025-47222-a-class-name-enumeration-was-found-in-keyfactor-signserver)