PT-2025-16217 · Veal98 · Veal98

Caigo · Published 2025-04-14 · Updated 2025-04-19 · CVE-2025-3566

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: veal98 小牛肉 Echo 开源社区系统 version 4.2

Description: A critical issue has been found in the function uploadMdPic of the file /discuss/uploadMdPic. The manipulation of the argument editormd-image-file leads to unrestricted upload. The attack may be initiated remotely.

Recommendations: For version 4.2, as a temporary workaround, consider disabling the uploadMdPic function until a patch is available. Restrict access to the /discuss/uploadMdPic endpoint to minimize the risk of exploitation. Avoid using the editormd-image-file argument in the affected endpoint until the issue is resolved.

Exploit

Fix

Unrestricted File Upload

XSS

Improper Access Control

Weakness Enumeration

CWE-434

CWE-79

CWE-284

Related Identifiers

CVE-2025-3566

Affected Products

Veal98

References · 14

• 🔥 https://github.com/caigo8/CVE-md · Exploit
• 🔥 https://github.com/caigo8/CVE-md/blob/main/Echo/%E6%9C%AA%E6%8E%88%E6%9D%83%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-3566 · Security Note
• https://vuldb.com/?submit.549509 · Note
• https://twitter.com/cracbot/status/1913548233902531059 · Twitter Post
• https://t.me/cvedetector/22847 · Telegram Post
• https://twitter.com/WolfgangSesin/status/1911599892218184083 · Twitter Post
• https://twitter.com/CVEnew/status/1911767828174155811 · Twitter Post
• https://vuldb.com/?ctiid.304607 · Note
• https://twitter.com/vulns_space/status/1911781266896138571 · Twitter Post
• https://vuldb.com/?id.304607 · Note
• https://t.me/latest_high_impact_cve/2139 · Telegram Post
• https://t.me/cvetracker/21531 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1911812051963371846 · Twitter Post