CVE-2025-34046
Published: 26 June 2025
Summary
CVE-2025-34046 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Org (inferred from references). Its CVSS base score is 10.0 (Critical).
Operationally, ranked in the top 11.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
An unauthenticated file upload vulnerability exists in the Fanwei E-Office web management interface at versions up to v9.4. The flaw resides in the /general/index/UploadFile.php endpoint, which fails to properly validate files uploaded when the parameters uploadType=eoffice_logo or uploadType=theme are supplied. This corresponds to CWE-434 and carries a CVSS 4.0 score of 10.0.
Attackers require no authentication and can exploit the issue by sending a crafted HTTP POST request to upload arbitrary files. Successful exploitation grants remote code execution on the server, enabling complete compromise of the web application and potentially the underlying host.
Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC. The current and peak EPSS score stands at 0.0422 with no material increase. Public references include proof-of-concept code and a Nuclei detection template tied to the related CNVD-2021-49104 identifier, along with entries from VulnCheck and CNVD.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-19208
Vulnerability details
An unauthenticated file upload vulnerability exists in the Fanwei E-Office <= v9.4 web management interface. The vulnerability affects the /general/index/UploadFile.php endpoint, which improperly validates uploaded files when invoked with certain parameters (uploadType=eoffice_logo or uploadType=theme). An attacker can exploit this flaw…
more
by sending a crafted HTTP POST request to upload arbitrary files without requiring authentication. Successful exploitation could enable remote code execution on the affected server, leading to complete compromise of the web application and potentially the underlying system. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring identifiable owners for portable devices reduces the attack surface for unrestricted uploads of dangerous file types via anonymous media.
Dangerous file uploads can be detonated in the chamber to determine malice before any production write or execution occurs.
Prevents unrestricted writing of arbitrary or malicious firmware by keeping hardware write-protect enabled except under tightly controlled manual procedures.
Scans files from external sources on download/open/execute, blocking unrestricted uploads of dangerous file types.