CVE-2025-4538
kkFileView fileUpload unrestricted upload
- State
- Published
- Severity
- 5.3 Medium
- Published
- May 11, 2025
- Updated
- May 12, 2025
- Reserved
- May 10, 2025
Description
A vulnerability was found in kkFileView 4.4.0. It has been classified as critical. This affects an unknown part of the file /fileUpload. The manipulation of the argument File leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
kkFileViewn/a |
|
References
- VDB-308283 | kkFileView fileUpload unrestricted uploadvdb-entrytechnical-description
- VDB-308283 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #566596 | kkFileView 4.4.0 Arbitrary File Writingthird-party-advisory
- https://magnificent-dill-351.notion.site/Arbitrary-File-Upload-in-kkFileView-4-4-0-1e3c693918ed802581faccab9140a130exploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.