CVE-2025-4259 - newbee-mall UploadController.java upload unrestricted upload

Back Back to CVE browser

MEDIUM

newbee-mall UploadController.java upload unrestricted upload

Published May 5, 2025

5.3

MEDIUM

CVSS 4.0

EPSS 0.53%

Description

A vulnerability has been found in newbee-mall 1.0 and classified as critical. Affected by this vulnerability is the function Upload of the file ltd/newbee/mall/controller/common/UploadController.java. The manipulation of the argument File leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.

Affected products

Vendor n/a Product Newbee-Mall Default
n/a
- Version
  1.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Newbee-Mall

n/a

Version	Status	Constraints
1.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-284

CWE-434

Unrestricted Upload of File

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-13328
Advisory
https://github.com/yaklang/IRifyScanResult/blob/main/newbee-mall/arbitrary-file-upload-in-uploadController.md
exploitMitigationThird Party Advisory
https://vuldb.com/?ctiid.307363
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.307363
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.562865
third-party-advisoryThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-13328		Advisory
https://github.com/yaklang/IRifyScanResult/blob/main/newbee-mall/arbitrary-file-upload-in-uploadController.md		exploitMitigationThird Party Advisory
https://vuldb.com/?ctiid.307363		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.307363		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.562865		third-party-advisoryThird Party AdvisoryVDB Entry