CVE-2025-11948

Critical

Published: 20 October 2025

Published

20 October 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v4 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0064 71.0th percentile

Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-11948 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Org (inferred from references). Its CVSS base score is 9.3 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 29.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-3 (Malicious Code Protection).

Deeper analysis

CVE-2025-11948 is an Arbitrary File Upload vulnerability (CWE-434) in the Document Management System developed by Excellent Infotek. Published on 2025-10-20, it enables unauthenticated remote attackers to upload web shell backdoors and execute them, resulting in arbitrary code execution on the affected server. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical.

Unauthenticated remote attackers can exploit this vulnerability over the network with low attack complexity, requiring no privileges or user interaction. Successful exploitation allows attackers to achieve high-impact compromise, including full arbitrary code execution on the server via uploaded web shells, potentially leading to complete system control.

Advisories from TWCERT/CC and CHT Security provide further details on the vulnerability, available at https://www.twcert.org.tw/en/cp-139-10453-43e63-2.html, https://www.twcert.org.tw/tw/cp-132-10452-72cb6-1.html, and https://www.chtsecurity.com/news/3575ad9c-31f4-49de-8bc4-de85bb2eed39.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-35025

Vulnerability details

Document Management System developed by Excellent Infotek has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

CWE(s): CWE-434

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1505.003 Web Shell Persistence

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

attack.mitre.org →

Why these techniques?

Arbitrary file upload in public-facing web application enables exploitation of public-facing app (T1190) and facilitates web shell deployment for RCE (T1505.003).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0