HIGH🇵🇱 Wersja polska

CVE-2025-65844

CVSS 7.5v3.1pub. 2025-12-02upd. 2025-12-06

EverShop 2.0.1 allows a remote unauthenticated attacker to upload arbitrary files and create directories via the /api/images endpoint. The endpoint is accessible without authentication by default, and server-side validation of uploaded files is insufficient. This can be abused to upload arbitrary content (including non-image files) which could impersonate user/admin login panels (exfiltrating credentials) and to perform a denial-of-service attack by exhausting disk space.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

  • Evershop

    APP
    Evershop
    2.0.1
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Auth Bypass
CWE
References

Related vulnerabilities

CVE-2026-28213CRITICAL9.8PL ✓ten sam produkt

EverShop: token resetowania hasła ujawniany w odpowiedzi API

CVE-2026-25993CRITICAL9.3PL ✓ten sam produkt

Second-order SQL injection w EverShop podczas obsługi kategorii

CVE-2023-46943CRITICAL9.1PL ✓ten sam produkt

Hardkodowany sekret HMAC w @evershop/evershop umożliwia fałszowanie tokenów JWT

CVE-2023-46498CRITICAL9.8PL ✓ten sam produkt

RCE i ujawnienie danych w EverShop NPM przez plik route.json

CVE-2025-67419HIGH7.5ten sam produkt

A Denial of Service (DoS) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaus...