CVE-2025-4291CWE-284CWE-434
IdeaCMS saveUpload unrestricted upload
Medium · published May 5, 2025
What it is
A vulnerability, which was classified as critical, was found in IdeaCMS up to 1.6. Affected is the function saveUpload. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
The record
Technical detail
- CVSS v4.0
- 5.3 · MEDIUM
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
- EPSS
- 0.00433 · 36.5th percentile
- Weaknesses
- CWE-284 · Improper Access Control; CWE-434 · Unrestricted Upload of File with Dangerous Type
- Published
- 2025-05-05T22:00Z
EPSS history
Timeline