CVE-2025-11318
BaseFortify
Publication date: 2025-10-06
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tipray | data_leakage_prevention_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-11318 is a security flaw in the Tipray Data Leakage Prevention System version 1.0, specifically in the file uploadWxFile.do interface. The vulnerability allows an attacker to manipulate the 'File' argument to perform unrestricted file uploads without proper validation or restrictions. This means unauthorized users can upload arbitrary files remotely, potentially leading to serious security risks such as data leakage or system compromise. [1, 2]
How can this vulnerability impact me? :
This vulnerability can have significant impacts including unauthorized data leakage, compromise of system integrity, and disruption of availability. Since attackers can upload arbitrary files remotely without authentication, they could introduce malicious files that the system might automatically process, leading to potential system takeover, data theft, or denial of service. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for unauthorized or unusual file upload attempts to the uploadWxFile.do endpoint of the Tipray Data Leakage Prevention System. Since the vulnerability involves unrestricted file upload via the 'File' argument, network traffic or web server logs can be inspected for POST requests to uploadWxFile.do containing file upload data. Commands such as using curl to test the endpoint for unrestricted upload can be used, for example: curl -X POST -F "File=@malicious_file" http://<target>/uploadWxFile.do. Additionally, web server logs can be searched with commands like: grep 'uploadWxFile.do' /var/log/httpd/access_log or equivalent to identify suspicious upload activity. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include disabling or restricting access to the uploadWxFile.do endpoint to prevent unauthorized file uploads. Since no patches or vendor responses are available, consider blocking or filtering requests to this endpoint at the network perimeter or web application firewall. If possible, replace or upgrade the affected Tipray Data Leakage Prevention System to a secure version or alternative product. Monitoring and alerting on suspicious upload activity should also be implemented to detect exploitation attempts. [2]