CVE-2025-31979CWE-434unrestricted-file-upload

CVE-2025-31979

Medium · published August 28, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
11.0
In the wild
Unconfirmed
What it is

A File Upload Validation Bypass vulnerability has been identified in the HCL BigFix SM, where the application fails to properly enforce file type restrictions during the upload process. An attacker may exploit this flaw to upload malicious or unauthorized files, such as scripts, executables, or web shells, by bypassing client-side or server-side validation mechanisms.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00212 · 11.0th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2025-08-28T21:15Z
References (1)
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0123631 · [email protected]
EPSS history
Timeline
  • 28 AUG 17:06Z
    A File Upload Validation Bypass vulnerability has been identified in the HCL BigFix Service Management (SM)
    cvelistv5