Erupt Unrestricted Upload of File with Dangerous Type vulnerability

MITTEL 5.4CVE-2025-45855 · GHSA-5gr5-vmmr-82g6 · Published 03/06/2025 · updated 17/06/2026

Kurz gesagt

CVE-2025-45855 ist eine Schwachstelle (MITTEL (CVSS 5.4)) in xyz.erupt:erupt, erupt (erupt).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.36%, höher als bei 30.3% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
xyz.erupt:erupt Maven	`≤ 1.12.19`	No fix yet
erupt erupt	`≤ 1.12.19`	No fix yet

Description

An arbitrary file upload vulnerability in the component /upload/GoodsCategory/image of erupt v1.12.19 allows attackers to execute arbitrary code via uploading a crafted file.

NVD description

An arbitrary file upload vulnerability in the component /upload/GoodsCategory/image of erupt v1.12.19 allows attackers to execute arbitrary code via uploading a crafted file.

References

nvd.nist.gov/vuln/detail/CVE-2025-45855 · ADVISORY
gist.github.com/Cafe-Tea/b72d442be434e1dafe7810c938892b06 · WEB
erupts/erupt · PACKAGE
erupt.xyz · WEB
erupt.xyz · Product

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free