CVE-2025-11948

Critical

Published: 20 October 2025

Published

20 October 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0037 58.9th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-11948 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Org (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 41.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-3 (Malicious Code Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

SI-10 mandates validation of all inputs including uploaded files for type, content, and structure to prevent arbitrary file uploads of web shells.

SI-3 Malicious Code Protection good match

preventdetect

SI-3 deploys malicious code protection mechanisms to scan for and block web shell uploads or execution attempts on the server.

SI-9 Information Input Restrictions good match

prevent

SI-9 restricts file uploads to only authorized types and formats, blocking executable web shells in the document management system.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1505.003 Web Shell Persistence

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

attack.mitre.org →

Why these techniques?

Arbitrary file upload in public-facing web application enables exploitation of public-facing app (T1190) and facilitates web shell deployment for RCE (T1505.003).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Document Management System developed by Excellent Infotek has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

Deeper analysisAI

CVE-2025-11948 is an Arbitrary File Upload vulnerability (CWE-434) in the Document Management System developed by Excellent Infotek. Published on 2025-10-20, it enables unauthenticated remote attackers to upload web shell backdoors and execute them, resulting in arbitrary code execution on the affected server. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical.

Unauthenticated remote attackers can exploit this vulnerability over the network with low attack complexity, requiring no privileges or user interaction. Successful exploitation allows attackers to achieve high-impact compromise, including full arbitrary code execution on the server via uploaded web shells, potentially leading to complete system control.

Advisories from TWCERT/CC and CHT Security provide further details on the vulnerability, available at https://www.twcert.org.tw/en/cp-139-10453-43e63-2.html, https://www.twcert.org.tw/tw/cp-132-10452-72cb6-1.html, and https://www.chtsecurity.com/news/3575ad9c-31f4-49de-8bc4-de85bb2eed39.