Cyber Posture

CVE-2025-61506

CriticalPublic PoC

Published: 03 February 2026

Published
03 February 2026
Modified
11 February 2026
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0025 47.9th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

An issue was discovered in MediaCrush thru 1.0.1 allowing remote unauthenticated attackers to upload arbitrary files of any size to the /upload endpoint.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly mitigates CWE-434 unrestricted file uploads by validating file types, sizes, and content at the /upload endpoint before acceptance.

AC-3 Access Enforcement good match
prevent

Prevents unauthenticated remote attackers from accessing the /upload endpoint by enforcing logical access controls requiring identification and authorization.

SC-14 Public Access Protections partial match
prevent

Provides protections for the publicly accessible /upload endpoint to limit unauthorized exploitation of unrestricted file upload capabilities.

Security SummaryAI

CVE-2025-61506, published on 2026-02-03, is a critical vulnerability (CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) affecting MediaCrush through version 1.0.1. The issue, tied to CWE-434 (Unrestricted Upload of File with Dangerous Type), enables remote unauthenticated attackers to upload arbitrary files of any size to the /upload endpoint.

Any remote attacker with network access can exploit this vulnerability without authentication, privileges, or user interaction due to its low attack complexity. Exploitation allows uploading files unrestricted by type or size, potentially granting high-impact access to confidentiality, integrity, and availability, such as executing malicious code if web servers process uploaded files.

Advisories reference a GitHub Gist at https://gist.github.com/pescada-dev/a046d36e8026bbaf1ee591c6dad0d7e6 for further details on the vulnerability.

Details

CWE(s)
CWE-434

Affected Products

mediacrush
mediacrush
≤ 1.0.1

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

CVE enables exploitation of a public-facing web application (/upload endpoint) for unauthenticated arbitrary file upload (T1190), facilitating deployment and execution of web shells (T1100).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References