CVE-2025-54769

Summary

An authenticated, read-only user can upload a file and perform a directory traversal to have the uploaded file placed in a location of their choosing. This can be used to overwrite existing PERL modules within the application to achieve remote code execution (RCE) by an attacker.

Affected Software

Weaknesses

• CWE-24: CWE-24 Path Traversal: '../filedir'
• CWE-434: CWE-434 Unrestricted Upload of File with Dangerous Type
• CWE-648: CWE-648 Incorrect Use of Privileged APIs

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: total

CVE Program Container

Additional References

• http://seclists.org/fulldisclosure/2025/Jul/19

References

• https://korelogic.com/Resources/Advisories/KL-001-2025-016.txt
• https://lpar2rrd.com/note800.php

• ←Previous
• Next→