CVE-2025-35032CWE-434unrestricted-file-upload

CVE-2025-35032

Low · published September 30, 2025

CVSS v3.1
3.4
EPSS
0%
Percentile
15.9
In the wild
Unconfirmed
What it is

Medical Informatics Engineering Enterprise Health allows authenticated users to upload arbitrary files. The impact of this behavior depends on how files are accessed. This issue is fixed as of 2025-04-08.

The record
Technical detail
CVSS v3.1
3.4 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00253 · 15.9th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2025-09-30T00:15Z
Affected products (5)
ProductVersionsFixed in
mieweb/enterprise_healthall versions—
mieweb/enterprise_healthall versions—
mieweb/enterprise_healthall versions—
mieweb/enterprise_healthall versions—
mieweb/enterprise_healthall versions—
References (2)
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-272-01.json · 9119a7d8-5eab-497f-8521-727c672e3725https://www.cve.org/CVERecord?id=CVE-2025-35032 · 9119a7d8-5eab-497f-8521-727c672e3725
EPSS history
Timeline
  • 29 SEP 20:01Z
    Medical Informatics Engineering Enterprise Health arbitrary file upload
    cvelistv5