CVE-2025-70023
Published: 14 April 2026
Summary
CVE-2025-70023 is a critical-severity Type Confusion (CWE-843) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2025-70023 is a vulnerability classified under CWE-843 (Access of Resource Using Incompatible Type) affecting transloadit uppy version 0.25.6. Uppy is an open-source JavaScript library for file uploading and processing. The issue was published on 2026-04-14T18:16:41.677 and carries a CVSS v3.1 base score of 9.8, indicating critical severity due to its network accessibility, low attack complexity, lack of required privileges or user interaction, and high impacts on confidentiality, integrity, and availability.
The vulnerability can be exploited by any remote attacker with network access to an affected Uppy instance, requiring no authentication, privileges, or user interaction. Successful exploitation allows the attacker to achieve high-level compromise, including unauthorized access to sensitive data (C:H), modification of system resources (I:H), and disruption of service availability (A:H), all within the unchanged security scope (S:U).
Mitigation details are available in referenced advisories, including a GitHub Gist at https://gist.github.com/zcxlighthouse/27926a85371ac5d2291f44903254753e, the Transloadit GitHub organization at https://github.com/transloadi, and the official Uppy repository at https://github.com/transloadit/uppy. Security practitioners should consult these sources for patch information, upgrade guidance, or workarounds specific to version 0.25.6.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-209459
Vulnerability details
An issue pertaining to CWE-843: Access of Resource Using Incompatible Type was discovered in transloadit uppy v0.25.6.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Critical remote type confusion in public-facing JS upload library directly enables unauthenticated exploitation of web-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the CWE-843 type confusion vulnerability in transloadit Uppy v0.25.6 by requiring timely patching or upgrading to a non-vulnerable version.
Enables detection of systems affected by CVE-2025-70023 through regular vulnerability scanning targeting the vulnerable Uppy v0.25.6 library.
Mitigates exploitation of the incompatible type access (CWE-843) in Uppy by validating inputs to prevent malformed data from triggering the vulnerability.