CVE-2025-67079

Critical

Published: 15 January 2026

Published

15 January 2026

Modified

21 January 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0014 32.9th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-67079 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Agora-Project Agora-Project. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Timely flaw remediation by upgrading to Omnispace Agora Project 25.10 patches the file upload vulnerability exploiting Imagick's MSL engine.

SI-10 Information Input Validation good match

prevent

Information input validation on file uploads rejects crafted PDFs that trigger arbitrary code execution via the MSL engine.

SI-9 Information Input Restrictions good match

prevent

Restricting file upload inputs to safe types and whitelisting prevents unrestricted upload of dangerous PDFs exploiting the vulnerability.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

The vulnerability allows unauthenticated remote attackers to achieve arbitrary code execution via crafted PDF file upload in a public-facing web application, directly mapping to exploitation of public-facing applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

File upload vulnerability in Omnispace Agora Project before 25.10 allowing attackers to execute code through the MSL engine of the Imagick library via crafted PDF file to the file upload and thumbnail functions.

Deeper analysisAI

CVE-2025-67079 is a file upload vulnerability in the Omnispace Agora Project prior to version 25.10. The issue affects the file upload and thumbnail functions, which leverage the MSL engine of the Imagick library for processing. By submitting a crafted PDF file, attackers can trigger arbitrary code execution through this component.

The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), making it highly severe. Unauthenticated remote attackers can exploit it over the network with low complexity and no user interaction, achieving high-impact effects on confidentiality, integrity, and availability. It is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type).

Advisories detailing mitigations are available at https://www.agora-project.net and https://www.helx.io/blog/advisory-agora-project/. Practitioners should upgrade to Omnispace Agora Project 25.10 or later to address the vulnerability.