CVE-2025-67079

Critical

Published: 15 January 2026

Published

15 January 2026

Modified

21 January 2026

KEV Added

—

Patch

—

CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0038 29.8th percentile

Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2025-67079 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Agora-Project Agora-Project. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-67079 is a file upload vulnerability in the Omnispace Agora Project prior to version 25.10. The issue affects the file upload and thumbnail functions, which leverage the MSL engine of the Imagick library for processing. By submitting a crafted PDF file, attackers can trigger arbitrary code execution through this component.

The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), making it highly severe. Unauthenticated remote attackers can exploit it over the network with low complexity and no user interaction, achieving high-impact effects on confidentiality, integrity, and availability. It is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type).

Advisories detailing mitigations are available at https://www.agora-project.net and https://www.helx.io/blog/advisory-agora-project/. Practitioners should upgrade to Omnispace Agora Project 25.10 or later to address the vulnerability.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-2759

Vulnerability details

File upload vulnerability in Omnispace Agora Project before 25.10 allowing attackers to execute code through the MSL engine of the Imagick library via crafted PDF file to the file upload and thumbnail functions.

CWE(s): CWE-434

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

The vulnerability allows unauthenticated remote attackers to achieve arbitrary code execution via crafted PDF file upload in a public-facing web application, directly mapping to exploitation of public-facing applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0