CVE-2025-55743
BaseFortify
Publication date: 2025-08-21
Last updated on: 2025-08-22
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| webkul | unopim | to 0.2.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in UnoPim before version 0.2.1 involves the image upload feature during user creation, which only performs client-side file type validation. An attacker can intercept the upload request using a proxy tool like Burp Suite, modify the file extension and content, and bypass the intended file type restrictions. This allows potentially malicious files to be uploaded.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to upload malicious files disguised as images, potentially leading to unauthorized code execution, data compromise, or system instability within the UnoPim application environment.
What immediate steps should I take to mitigate this vulnerability?
Upgrade UnoPim to version 0.2.1 or later, as this version fixes the vulnerability by addressing the insufficient server-side validation of uploaded image files.