CVE-2025-14532CWE-434

Remote Code Execution via Unrestricted File Upload in DobryCMS

Critical · published March 2, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
46.4
In the wild
Unconfirmed
What it is

DobryCMS's upload file functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can result in Remote Code Execution.

This issue was fixed in versions above 5.0.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
EPSS
0.00570 · 46.4th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-03-02T12:49Z
EPSS history
Timeline
  • 02 MAR 12:49Z
    Remote Code Execution via Unrestricted File Upload in DobryCMS
    cvelistv5