CVE-2025-1980

Remote Code Execution via Unrestricted File Upload in Ready_

CVSS 7.1 HIGHEPSS 0.8%CWE-434

Vexday Risk Score

21Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 7.1EPSS 0.8%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

16 abr 2025Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

The Ready_ application's Profile section allows users to upload files of any type and extension without restriction. If the server is misconfigured, as it was by default when installed at the turn of 2021 and 2022, it can result in Remote Code Execution. Refer to the Required Configuration for Exposure section for more information.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Productos afectados

Symfonia · Ready_

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

https://cert.pl/en/posts/2025/04/CVE-2025-1980 https://cert.pl/posts/2025/04/CVE-2025-1980 https://ready-os.com/pl/