PT-2025-45665

Published

2025-10-29

·

Updated

2025-10-29

Description by

CVSS 3.1
10
Critical
MetricsAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Summary

The default HTML editor provider allows unauthenticated file uploads and images can overwrite existing files.

Description

An unauthenticated user can upload and replace existing files allowing defacing a website and combined with other issue, injection XSS payloads.
Exploitability
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-434: Unrestricted Upload of File with Dangerous Type
Related identifiers
GHSA-3M8R-W7XG-JQVW
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com