CVE-2025-26350
Published: 12 February 2025
Summary
CVE-2025-26350 is a medium-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Q-Free Maxtime. Its CVSS base score is 4.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Web Shell (T1505.003); ranked at the 27.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly validates the type and content of uploaded template files to prevent unrestricted upload of dangerous file types as described in this CWE-434 vulnerability.
Restricts the types of files accepted by the template upload component, blocking malicious files from high-privilege authenticated attackers.
Remediates the specific unrestricted file upload flaw in Q-Free MaxTime <= 2.11.0 through timely patching and flaw correction.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unrestricted upload of dangerous files to template uploads enables exploitation of public-facing web applications (T1190), web shell deployment (T1100), template injection via malicious templates (T1221), and malware staging through file uploads (T1608.001), potentially leading to arbitrary file overwrites and system compromise.
NVD Description
A CWE-434 "Unrestricted Upload of File with Dangerous Type" in the template file uploads in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to upload malicious files via crafted HTTP requests.
Deeper analysisAI
CVE-2025-26350, published on 2025-02-12, is a CWE-434 unrestricted upload of file with dangerous type vulnerability in the template file uploads component of Q-Free MaxTime versions less than or equal to 2.11.0. It enables an authenticated remote attacker to upload malicious files through crafted HTTP requests. The vulnerability has a CVSS v3.1 base score of 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N), indicating medium severity with high integrity impact but no effects on confidentiality or availability.
An attacker requires high privileges (PR:H) to exploit this vulnerability over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Exploitation allows uploading arbitrary malicious files, potentially leading to integrity violations such as executing unauthorized code or altering system templates within the affected MaxTime instance.
Mitigation details are available in the advisory published by Nozomi Networks at https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26350.
Details
- CWE(s)