{"id":"CVE-2025-14532","aliases":["EUVD-2025-208154","GHSA-mrvp-mhjr-mj2j"],"status":"published","title":"Remote Code Execution via Unrestricted File Upload in DobryCMS","description":"DobryCMS's upload file functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can result in Remote Code Execution.\n\nThis issue was fixed in versions above 5.0.","severity":{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00623,"percentile":0.50173,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-434"],"published":"2026-03-02T12:49:05Z","modified":"2026-06-17T08:36:05Z","products":[{"vendor":"studio fabryka","product":"dobrycms"},{"vendor":"studiofabryka","product":"dorbycms"}],"references":[{"url":"https://cert.pl/posts/2026/03/CVE-2025-12462/","tags":["Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14532"},{"url":"https://cert.pl/posts/2026/03/CVE-2025-12462"},{"url":"https://github.com/advisories/GHSA-mrvp-mhjr-mj2j"}],"sources":{"cve":[{"id":"CVE-2025-14532","title":"Remote Code Execution via Unrestricted File Upload in DobryCMS","description":"DobryCMS's upload file functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can result in Remote Code Execution.\n\nThis issue was fixed in versions above 5.0.","status":"published","published":"2026-03-02T12:49:05.217Z","modified":"2026-03-02T13:34:55.888Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","level":"critical","assessor":"cna"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:32:28.250136Z"}],"euvd":[{"id":"EUVD-2025-208154","description":"DobryCMS's upload file functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can result in Remote Code Execution.\n\nThis issue was fixed in versions above 5.0.","status":"published","published":"2026-03-02T12:49:05Z","modified":"2026-03-02T13:34:55Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","level":"critical"}],"updated_at":"2026-11-02T19:48:13.147525Z"}],"ghsa":[{"id":"GHSA-mrvp-mhjr-mj2j","title":"DobryCMS's upload file functionality allows an unauthenticated remote attacker to upload files of...","description":"DobryCMS's upload file functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can result in Remote Code Execution.\n\nThis issue was fixed in versions above 5.0.","status":"published","published":"2026-03-02T15:31:24Z","modified":"2026-03-05T18:31:35Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T15:06:27.497427Z"}],"nvd":[{"id":"CVE-2025-14532","description":"DobryCMS's upload file functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can result in Remote Code Execution.\n\nThis issue was fixed in versions above 5.0.","status":"published","published":"2026-03-02T13:16:04.153Z","modified":"2026-06-17T08:36:05.75Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:12:01.096037Z"}]}}