CVE-2025-1980
Remote Code Execution via Unrestricted File Upload in Ready_
- State
- Published
- Severity
- 7.1 High
- Published
- Apr 16, 2025
- Updated
- Apr 16, 2025
- Reserved
- Mar 5, 2025
Description
The Ready_ application's Profile section allows users to upload files of any type and extension without restriction. If the server is misconfigured, as it was by default when installed at the turn of 2021 and 2022, it can result in Remote Code Execution. Refer to the Required Configuration for Exposure section for more information.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N | CERT-PL |
| 4.0 | 9.4 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H | CERT-PL |
Weaknesses
- CWE-434 Unrestricted Upload of File with Dangerous Type
Affected Products
| Product | Versions |
|---|---|
Ready_Symfonia |
|
References
- https://cert.pl/posts/2025/04/CVE-2025-1980third-party-advisory
- https://cert.pl/en/posts/2025/04/CVE-2025-1980third-party-advisory
- https://ready-os.com/pl/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.