CVE-2025-0645CWE-434unrestricted-file-upload

CVE-2025-0645

High · published November 20, 2025

CVSS v3.1
7.2
EPSS
0%
Percentile
30.2
In the wild
Unconfirmed
What it is

🚨 An unrestricted file upload vulnerability lets attackers slip in dangerous files! Pyxis Signage might be hosting more than just signs, and that’s a security nightmare. 🔥 Think of it like a post office that accepts any parcel without checking its contents. If a malicious package gets through the sorting system, the results could be catastrophic — just like an unauthorized file could compromise your server! An attacker could exploit this vulnerability to upload malicious files, granting them unauthorized access to sensitive functionalities. This could lead to devastating consequences, like data breaches or even total control of the system, unleashing chaos in your organization!

Put simply

Think of it like a post office that accepts any parcel without checking its contents. If a malicious package gets through the sorting system, the results could be catastrophic — just like an unauthorized file could compromise your server! This vulnerability in Pyxis Signage allows files of any type to be uploaded without proper restrictions, bypassing Access Control Lists (ACLs). As a result, this can lead to execution of harmful scripts or files on the server.

What to do

An attacker could exploit this vulnerability to upload malicious files, granting them unauthorized access to sensitive functionalities. This could lead to devastating consequences, like data breaches or even total control of the system, unleashing chaos in your organization! Patch your Pyxis Signage to the latest version immediately, ensuring that file upload mechanisms enforce strict type validation and ACL checks. Review your current configurations to prevent similar vulnerabilities from creeping in during future updates. You've got this! Follow these steps, and you’ll have your system locked down tighter than a drum in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00375 · 30.2th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2025-11-20T20:17Z
References (2)
EPSS history
Timeline
  • 20 NOV 13:33Z
    Arbitrary File Upload in Narkom Communication Technologies' Pyxis Signage
    cvelistv5