Cyber Posture

CVE-2025-26350

Medium

Published: 12 February 2025

Published
12 February 2025
Modified
24 October 2025
KEV Added
—
Patch
—
CVSS Score 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
EPSS Score 0.0010 27.3th percentile
Risk Priority 10 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may upload malware to third-party or adversary controlled infrastructure to make it accessible during targeting.

Security Summary

CVE-2025-26350, published on 2025-02-12, is a CWE-434 unrestricted upload of file with dangerous type vulnerability in the template file uploads component of Q-Free MaxTime versions less than or equal to 2.11.0. It enables an authenticated remote attacker to upload malicious files through crafted HTTP requests. The vulnerability has a CVSS v3.1 base score of 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N), indicating medium severity with high integrity impact but no effects on confidentiality or availability.

An attacker requires high privileges (PR:H) to exploit this vulnerability over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Exploitation allows uploading arbitrary malicious files, potentially leading to integrity violations such as executing unauthorized code or altering system templates within the affected MaxTime instance.

Mitigation details are available in the advisory published by Nozomi Networks at https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26350.

Details

CWE(s)
CWE-434

Affected Products

q-free
maxtime
≤ 2.11.0

MITRE ATT&CK Enterprise Techniques

T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1221 Template Injection Stealth
Adversaries may create or modify references in user document templates to conceal malicious code or force authentication attempts.
attack.mitre.org →
T1608.001 Upload Malware Resource Development
Adversaries may upload malware to third-party or adversary controlled infrastructure to make it accessible during targeting.
attack.mitre.org →
Why these techniques?

Unrestricted upload of dangerous files to template uploads enables exploitation of public-facing web applications (T1190), web shell deployment (T1100), template injection via malicious templates (T1221), and malware staging through file uploads (T1608.001), potentially leading to arbitrary file overwrites and system compromise.

References