CVE-2025-50848

A file upload vulnerability was discovered in CS Cart 4.18.3, allows attackers to execute arbitrary code

Medium · published July 31, 2025

CVSS v3.1
6.1
EPSS
0%
Percentile
15.0
In the wild
Unconfirmed
What it is

A file upload vulnerability was discovered in CS Cart 4.18.3, allows attackers to execute arbitrary code. CS Cart 4.18.3 allows unrestricted upload of HTML files, which are rendered directly in the browser when accessed. This allows an attacker to upload a crafted HTML file containing malicious content, such as a fake login form for credential harvesting or scripts for Cross-Site Scripting (XSS) attacks. Since the content is served from a trusted domain, it significantly increases the likelihood of successful phishing or script execution against other users.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00246 · 15.0th percentile
Published
2025-07-31T00:00Z
EPSS history
Timeline
  • 31 JUL 00:00Z
    A file upload vulnerability was discovered in CS Cart 4.18.3, allows attackers to execute arbitrary code
    cvelistv5