CVE-2025-59872CWE-209CWE-434unrestricted-file-upload

CVE-2025-59872

Medium · published June 17, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
38.4
In the wild
Unconfirmed
What it is

HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability, If the server is configured to execute code, then it may be possible to obtain command execution on the server by uploading a file known as a web shell, which allows you to execute arbitrary code or operating system commands. For this attack to be successful, the file needs to be uploaded inside the Webroot, and the server must be configured to execute the code

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00454 · 38.4th percentile
Weaknesses
CWE-209 · Generation of Error Message Containing Sensitive Information; CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-06-17T17:19Z
Affected products (1)
ProductVersionsFixed in
hcltech/zie_for_weball versions—
References (1)
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131549 · [email protected]
EPSS history
Timeline
  • 17 JUN 12:32Z
    HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability,
    cvelistv5