CVE-2025-8526
Published: 04 August 2025
Summary
CVE-2025-8526 is a low-severity Improper Access Control (CWE-284) vulnerability in Exrick Xboot. Its CVSS base score is 2.1 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Upload Tool (T1608.002); ranked in the top 45.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-8526 is a critical vulnerability in Exrick xboot versions up to 3.3.4, affecting the Upload function in the file xboot-fast/src/main/java/cn/exrick/xboot/modules/base/controller/common/UploadController.java. The issue enables unrestricted file upload through manipulation of the File argument and has a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). It is associated with CWE-284 (Improper Access Control) and CWE-434 (Unrestricted Upload of File with Dangerous Type). The vulnerability was published on 2025-08-04.
A remote attacker with low privileges can exploit this vulnerability by manipulating the File argument in the Upload function. Successful exploitation allows unrestricted file upload, potentially leading to low-level impacts on confidentiality, integrity, and availability.
Advisories and details are documented in GitHub issues at https://github.com/Exrick/xboot/issues/71 and https://github.com/Exrick/xboot/issues/71#issue-3252446955, as well as VulDB entries at https://vuldb.com/?ctiid.318652, https://vuldb.com/?id.318652, and https://vuldb.com/?submit.622173. The exploit has been disclosed publicly and may be used.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-23549
Vulnerability details
A vulnerability was found in Exrick xboot up to 3.3.4. It has been declared as critical. This vulnerability affects the function Upload of the file xboot-fast/src/main/java/cn/exrick/xboot/modules/base/controller/common/UploadController.java. The manipulation of the argument File leads to unrestricted upload. The attack can be…
more
initiated remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unrestricted file upload vulnerability (CWE-434) in Exrick xboot's UploadController allows remote attackers to upload arbitrary files, including tools, directly mapping to T1608.002: Upload Tool as declared in the VulDB advisory.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces validation of uploaded file content and type before acceptance, directly blocking the unrestricted File argument manipulation in UploadController.java.
Enforces access control policy on the upload operation so that only permitted file types and users can succeed, addressing the CWE-284 improper access control root cause.
Restricts the web application to least functionality by disabling or constraining the Upload function unless explicitly required, reducing the attack surface exposed in xboot <= 3.3.4.