CVE-2025-55061CWE-434unrestricted-file-upload

CVE-2025-55061

High · published December 29, 2025

CVSS v3.1
8.8
EPSS
0%
Percentile
25.6
In the wild
Unconfirmed
What it is

⚡ An unrestricted file upload vulnerability lets anyone toss dangerous files into your server like an unmonitored drop-off box! 🔥 Think of it as a mailroom that accepts any package without checking the contents — you might receive a lovely gift or a hazardous surprise! An attacker could upload malicious scripts or executable files, giving them the keys to your server! This means they could gain unauthorized access, manipulate data, or even launch attacks against unsuspecting users, leading to potential data breaches or service outages. Yikes!

Put simply

Think of it as a mailroom that accepts any package without checking the contents — you might receive a lovely gift or a hazardous surprise! This vulnerability allows attackers to upload files without proper restrictions, which can include executable code or scripts that could be harmful when executed by the server.

What to do

An attacker could upload malicious scripts or executable files, giving them the keys to your server! This means they could gain unauthorized access, manipulate data, or even launch attacks against unsuspecting users, leading to potential data breaches or service outages. Yikes! Immediately implement file type validation on uploads to ensure only safe formats are allowed. Also, consider using a separate upload directory with restricted permissions and conduct regular security audits of your upload functionalities. You've got this! Follow these steps, and you'll be a security hero in no time! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00335 · 25.6th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2025-12-29T23:15Z
References (1)
EPSS history
Timeline
  • 29 DEC 17:14Z
    Priority - CWE-434 Unrestricted Upload of File with Dangerous Type
    cvelistv5