PT-2025-13277 · Unknown · Elunez Eladmin

S1Mple_Xy · Published 2025-03-27 · Updated 2025-03-27 · CVE-2025-2855

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions elunez eladmin versions up to 2.7

Description A problematic issue has been found, affecting the function checkFile of the file "/api/deploy/upload". The manipulation of the argument servers leads to deserialization. This issue can be exploited remotely.

Recommendations For elunez eladmin versions up to 2.7, as a temporary workaround, consider disabling the checkFile function until a patch is available. Restrict access to the "/api/deploy/upload" endpoint to minimize the risk of exploitation. Avoid using the servers argument in the affected API endpoint until the issue is resolved.

Fix

Deserialization of Untrusted Data

RCE

Weakness Enumeration

CWE-502

CWE-20

Related Identifiers

CVE-2025-2855

Affected Products

Elunez Eladmin

References · 7

• https://github.com/elunez/eladmin/issues/873 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-2855 · Security Note
• https://osv.dev/vulnerability/CVE-2025-2855 · Vendor Advisory
• https://vuldb.com/?submit.522504 · Note
• https://twitter.com/CVEnew/status/1905300587996217733 · Twitter Post
• https://vuldb.com/?ctiid.301502 · Note
• https://vuldb.com/?id.301502 · Note