{"id":"CVE-2025-45855","aliases":["EUVD-2025-16730","GHSA-5gr5-vmmr-82g6"],"status":"published","title":"Erupt Unrestricted Upload of File with Dangerous Type vulnerability","description":"An arbitrary file upload vulnerability in the component /upload/GoodsCategory/image of erupt v1.12.19 allows attackers to execute arbitrary code via uploading a crafted file.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00363,"percentile":0.3044,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-434"],"published":"2025-06-03T00:00:00Z","modified":"2026-10-28T02:30:40Z","affected":[{"source":"ghsa","ecosystem":"Maven","package":"xyz.erupt:erupt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.12.19"}]}]},{"source":"osv","ecosystem":"Maven","package":"xyz.erupt:erupt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.12.19"}]}],"versions":["1.10.0-beta","1.10.1","1.10.10","1.10.10-beta","1.10.10-beta2","1.10.11","1.10.12","1.10.13","1.10.14","1.10.15","1.10.2","1.10.3","1.10.4","1.10.5","1.10.6","1.10.7","1.10.8","1.10.8-beta","1.10.8-beta.2","1.10.8-beta.3","1.10.8-beta.4","1.10.9","1.10.9-beta","1.10.beta","1.11.1","1.11.2","1.11.3","1.11.4","1.11.5","1.11.6","1.11.7","1.12.0","1.12.1","1.12.10","1.12.11","1.12.12","1.12.13","1.12.14","1.12.15","1.12.16","1.12.17","1.12.18","1.12.19","1.12.2","1.12.3","1.12.4","1.12.5","1.12.6","1.12.7","1.12.8","1.12.9","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.6.1","1.6.10","1.6.11","1.6.12","1.6.13","1.6.14","1.6.15","1.6.16","1.6.3","1.6.4","1.6.5","1.6.7","1.6.8","1.6.9","1.7.0","1.7.1","1.7.2","1.7.3","1.8.0","1.8.1","1.8.2","1.8.3","1.8.4","1.8.5","1.9.0","1.9.0-bate","1.9.0-bate2","1.9.1","1.9.2","1.9.3"]}],"products":[{"vendor":"erupt","product":"erupt"}],"references":[{"url":"https://github.com/erupts/erupt","tags":["Product","package"]},{"url":"https://www.erupt.xyz/#%21/","tags":["Product","web"]},{"url":"https://gist.github.com/Cafe-Tea/b72d442be434e1dafe7810c938892b06","tags":["Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-45855","tags":["advisory"]},{"url":"https://www.erupt.xyz/#!","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5gr5-vmmr-82g6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/45xxx/CVE-2025-45855.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-45855","description":"An arbitrary file upload vulnerability in the component /upload/GoodsCategory/image of erupt v1.12.19 allows attackers to execute arbitrary code via uploading a crafted file.","status":"published","published":"2025-06-03T00:00:00Z","modified":"2025-06-03T18:23:10.643Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:32:36.385228Z"}],"euvd":[{"id":"EUVD-2025-16730","description":"An arbitrary file upload vulnerability in the component /upload/GoodsCategory/image of erupt v1.12.19 allows attackers to execute arbitrary code via uploading a crafted file.","status":"published","published":"2025-06-03T00:00:00Z","modified":"2025-06-03T18:23:10Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:30.496028Z"}],"ghsa":[{"id":"GHSA-5gr5-vmmr-82g6","title":"Erupt Unrestricted Upload of File with Dangerous Type vulnerability","description":"An arbitrary file upload vulnerability in the component /upload/GoodsCategory/image of erupt v1.12.19 allows attackers to execute arbitrary code via uploading a crafted file.","status":"published","published":"2025-06-03T15:31:26Z","modified":"2025-06-05T22:03:43Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:38:45.948817Z"}],"nvd":[{"id":"CVE-2025-45855","description":"An arbitrary file upload vulnerability in the component /upload/GoodsCategory/image of erupt v1.12.19 allows attackers to execute arbitrary code via uploading a crafted file.","status":"published","published":"2025-06-03T14:15:48.75Z","modified":"2026-06-17T09:25:46.47Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:11:10.143444Z"}],"osv":[{"id":"CVE-2025-45855","description":"An arbitrary file upload vulnerability in the component /upload/GoodsCategory/image of erupt v1.12.19 allows attackers to execute arbitrary code via uploading a crafted file.","status":"published","published":"2025-06-03T00:00:00Z","modified":"2026-10-28T02:30:40.823458064Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:49.707645Z"},{"id":"GHSA-5gr5-vmmr-82g6","title":"Erupt Unrestricted Upload of File with Dangerous Type vulnerability","description":"An arbitrary file upload vulnerability in the component /upload/GoodsCategory/image of erupt v1.12.19 allows attackers to execute arbitrary code via uploading a crafted file.","status":"published","published":"2025-06-03T15:31:26Z","modified":"2025-06-05T22:27:13.819471Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T15:46:38.213481Z"}]}}