CVE-2025-33015
Published: 20 January 2026
Summary
CVE-2025-33015 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Ibm Concert. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Web Shell (T1505.003); ranked at the 17.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-33015 affects IBM Concert versions 1.0.0 through 2.1.0, where the web interface fails to validate the content of uploaded files, enabling malicious file uploads. This vulnerability, associated with CWE-434 (Unrestricted Upload of File with Dangerous Type), carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact on confidentiality, integrity, and availability.
A remote attacker with no required privileges can exploit this vulnerability over the network with low complexity by tricking a user into uploading a specially crafted malicious file via the web interface. Successful exploitation requires user interaction but can result in high-impact compromise, allowing the attacker to execute arbitrary code, steal data, modify system files, or disrupt services on the affected system.
IBM has published an advisory at https://www.ibm.com/support/pages/node/7257006, which provides details on mitigation steps and available patches for resolving the file validation issue in the web interface. Security practitioners should review this page for version-specific remediation guidance.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3360
Vulnerability details
IBM Concert 1.0.0 through 2.1.0 is vulnerable to malicious file upload by not validating the content of the file uploaded to the web interface.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unrestricted file upload (CWE-434) on a web interface directly enables deployment of web shells or malicious server components for code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces validation of uploaded file content to block malicious files in the web interface.
Remediates the specific file validation flaw through timely patching of IBM Concert as advised.
Scans and blocks malicious code in uploaded files, mitigating exploitation even if validation fails.