PT-2025-22766 · Staggs · Staggs

Astra.R3Verii · CVE-2025-47637 · Published 2025-05-23 · Updated 2026-05-26

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions STAGGS versions n/a through 2.11.0

Description The issue allows for the unrestricted upload of files with dangerous types, enabling the upload of a web shell to a web server. This can lead to potential security breaches.

Recommendations For versions n/a through 2.11.0, consider restricting file uploads to only allow safe file types and implement proper validation and sanitization of uploaded files to prevent the upload of malicious content, such as web shells. As a temporary workaround, consider disabling file upload functionality until a proper fix is applied.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-47637

Affected Products

Staggs

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-47637 · Security Note
• https://patchstack.com/database/wordpress/plugin/staggs/vulnerability/wordpress-staggs-2-10-1-arbitrary-file-upload-vulnerability?_s_id=cve · Note
• https://twitter.com/HugoValters/status/2059269853609906296 · Twitter Post
• https://twitter.com/HugoValters/status/2059148392157098024 · Twitter Post
• https://twitter.com/CVEnew/status/1926244454320517236 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/staggs/vulnerability/wordpress-staggs-2-10-1-arbitrary-file-upload-vulnerability?_s_id=cve · Note