{"id":"CVE-2025-65844","aliases":["EUVD-2025-200288","GHSA-c88j-gfxj-293x"],"status":"published","title":"EverShop 2.0.1 allows an unauthenticated user to upload files and create directories within the ...","description":"EverShop 2.0.1 allows a remote unauthenticated attacker to upload arbitrary files and create directories via the /api/images endpoint. The endpoint is accessible without authentication by default, and server-side validation of uploaded files is insufficient. This can be abused to upload arbitrary content (including non-image files) which could impersonate user/admin login panels (exfiltrating credentials) and to perform a denial-of-service attack by exhausting disk space.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00398,"percentile":0.34299,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-434"],"published":"2025-12-02T00:00:00Z","modified":"2026-11-04T23:10:00Z","products":[{"vendor":"evershop","product":"evershop"}],"references":[{"url":"https://github.com/evershopcommerce/evershop/issues/819","tags":["Exploit","Issue Tracking","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-65844","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-c88j-gfxj-293x"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65844.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-65844","description":"EverShop 2.0.1 allows a remote unauthenticated attacker to upload arbitrary files and create directories via the /api/images endpoint. The endpoint is accessible without authentication by default, and server-side validation of uploaded files is insufficient. This can be abused to upload arbitrary content (including non-image files) which could impersonate user/admin login panels (exfiltrating credentials) and to perform a denial-of-service attack by exhausting disk space.","status":"published","published":"2025-12-02T00:00:00Z","modified":"2025-12-06T03:51:57.318Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:32:26.64278Z"}],"euvd":[{"id":"EUVD-2025-200288","description":"EverShop 2.0.1 allows a remote unauthenticated attacker to upload arbitrary files and create directories via the /api/images endpoint. The endpoint is accessible without authentication by default, and server-side validation of uploaded files is insufficient. This can be abused to upload arbitrary content (including non-image files) which could impersonate user/admin login panels (exfiltrating credentials) and to perform a denial-of-service attack by exhausting disk space.","status":"published","published":"2025-12-02T00:00:00Z","modified":"2025-12-06T03:51:57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T19:49:09.057321Z"}],"ghsa":[{"id":"GHSA-c88j-gfxj-293x","title":"EverShop 2.0.1 allows an unauthenticated user to upload files and create directories within the ...","description":"EverShop 2.0.1 allows an unauthenticated user to upload files and create directories within the /api/images endpoint.","status":"published","published":"2025-12-02T18:30:36Z","modified":"2025-12-03T15:31:32Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T15:05:01.323335Z"}],"nvd":[{"id":"CVE-2025-65844","description":"EverShop 2.0.1 allows a remote unauthenticated attacker to upload arbitrary files and create directories via the /api/images endpoint. The endpoint is accessible without authentication by default, and server-side validation of uploaded files is insufficient. This can be abused to upload arbitrary content (including non-image files) which could impersonate user/admin login panels (exfiltrating credentials) and to perform a denial-of-service attack by exhausting disk space.","status":"published","published":"2025-12-02T18:15:49.243Z","modified":"2026-11-04T23:10:00.223Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-434"],"updated_at":"2026-11-05T01:45:08.806554Z"}],"osv":[{"id":"CVE-2025-65844","description":"EverShop 2.0.1 allows a remote unauthenticated attacker to upload arbitrary files and create directories via the /api/images endpoint. The endpoint is accessible without authentication by default, and server-side validation of uploaded files is insufficient. This can be abused to upload arbitrary content (including non-image files) which could impersonate user/admin login panels (exfiltrating credentials) and to perform a denial-of-service attack by exhausting disk space.","status":"published","published":"2025-12-02T00:00:00Z","modified":"2026-11-05T21:16:20.601126337Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-05T22:00:58.054534Z"}]}}