CVE-2025-2219
Published: 12 March 2025
Summary
CVE-2025-2219 is a medium-severity Improper Access Control (CWE-284) vulnerability in Lovecards Lovecards. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-2219 is a critical vulnerability in LoveCards LoveCardsV2 up to version 2.3.2, affecting the processing of the /api/upload/image file endpoint. The issue allows manipulation of the 'file' argument, resulting in unrestricted file upload, and is classified under CWE-284 (Improper Access Control) and CWE-434 (Unrestricted Upload of File with Dangerous Type). It carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and was published on 2025-03-12.
Remote attackers can exploit this vulnerability without authentication or user interaction, initiating the attack over the network with low complexity. By manipulating the file argument in the affected endpoint, attackers achieve unrestricted file upload, which a public disclosure details as enabling an unauthenticated path to remote code execution (RCE).
Advisories from VulDB and a detailed Notion write-up confirm the exploit has been publicly disclosed and may be used. The vendor was contacted early about the issue but did not respond, and no patches or specific mitigations are mentioned in the available references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7553
Vulnerability details
A vulnerability was found in LoveCards LoveCardsV2 up to 2.3.2 and classified as critical. This issue affects some unknown processing of the file /api/upload/image. The manipulation of the argument file leads to unrestricted upload. The attack may be initiated remotely.…
more
The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in public-facing web app endpoint enables exploitation of T1190 for initial access; unrestricted file upload directly facilitates T1505.003 web shell deployment for unauthenticated RCE.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates unrestricted file uploads by requiring validation of the 'file' argument at the /api/upload/image endpoint to reject dangerous types and disguised executables.
Restricts inputs to the upload endpoint to safe file types, sizes, and formats, preventing manipulation that allows dangerous file uploads.
Enforces approved access authorizations on the /api/upload/image endpoint to block improper access control allowing unauthenticated file manipulation.