CVE-2025-14532

Received Received - Intake

Unrestricted File Upload in DobryCMS Enables Remote Code Execution

Publication date: 2026-03-02

Last updated on: 2026-03-05

Assigner: CERT.PL

Description

DobryCMS's upload file functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can result in Remote Code Execution. This issue was fixed in versions above 5.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-02

Last Modified

2026-03-05

Generated

2026-07-06

AI Q&A

2026-03-02

EPSS Evaluated

2026-07-05

NVD

CVE-2025-14532

EUVD

EUVD-2025-208154

Affected Vendors & Products

Vendor	Product	Version / Range
studiofabryka	dorbycms	From 1.0 (inc) to 5.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

The vulnerability in DobryCMS is related to its upload file functionality, which allows an unauthenticated remote attacker to upload files of any type and extension without any restriction.

This lack of restriction can lead to Remote Code Execution, meaning the attacker could run malicious code on the affected system.

The issue was fixed in versions above 5.0.

Impact Analysis

This vulnerability can have a severe impact because it allows an attacker to execute arbitrary code remotely without authentication.

Such an attack could lead to full system compromise, data theft, data loss, or disruption of services.

Given the high CVSS score of 9.3, it indicates a critical severity level with a high potential impact.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

The vulnerability in DobryCMS allows unauthenticated remote attackers to upload files of any type, leading to Remote Code Execution.

To mitigate this vulnerability immediately, upgrade DobryCMS to a version above 5.0 where this issue has been fixed.

Hi! I’m here to help you understand CVE-2025-14532. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70