Unrestricted File Upload in Themify Shopo Enables Remote Code Execution

Publication date: 2026-01-05

Last updated on: 2026-04-28

Assigner: Patchstack

Description

Unrestricted Upload of File with Dangerous Type vulnerability in Themify Shopo allows Upload a Web Shell to a Web Server.This issue affects Shopo: from n/a through 1.1.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-05

Last Modified

2026-04-28

Generated

2026-07-06

AI Q&A

2026-01-05

EPSS Evaluated

2026-07-05

NVD

CVE-2025-31048

Affected Vendors & Products

Vendor	Product	Version / Range
themify	shopo	to 1.1.4 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

This vulnerability in Themify Shopo allows an attacker to upload a web shell to the web server due to unrestricted upload of files with dangerous types. This means malicious files can be uploaded and executed on the server.

Impact Analysis

The vulnerability can lead to severe impacts including full compromise of the web server, allowing attackers to execute arbitrary code, steal data, disrupt services, and potentially gain further access to the network.

Hi! I’m here to help you understand CVE-2025-31048. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70