PT-2025-26162 · Efrotech · Efrotech Timetrax

Noman Azam · Published 2025-06-18 · Updated 2025-06-26 · CVE-2025-46157

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EfroTech Time Trax version 1.0

Description An issue in EfroTech Time Trax allows a remote attacker to execute arbitrary code via the file attachment function in the leave request form. This is related to the CWE-434 Unrestricted Upload of File with Dangerous Type. The attacker can exploit this issue to execute arbitrary code.

Recommendations For EfroTech Time Trax version 1.0, consider disabling the file attachment function in the leave request form until a patch is available to prevent remote attackers from executing arbitrary code. Restrict access to the leave request form to minimize the risk of exploitation. Avoid using the file attachment feature in the affected form until the issue is resolved.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-46157

Affected Products

Efrotech Timetrax

References · 10

• 🔥 https://github.com/morphine009/CVE-2025-46157 · Exploit
• https://osv.dev/vulnerability/CVE-2025-46157 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-46157 · Security Note
• http://timetrax.com · Note
• https://t.me/cvetracker/26508 · Telegram Post
• https://twitter.com/CVEnew/status/1935727416904654988 · Twitter Post
• https://t.me/cvenotify/126750 · Telegram Post
• http://efrotech.com · Note
• https://twitter.com/cracbot/status/1937103406130442551 · Twitter Post
• https://t.me/latest_high_impact_cve/2706 · Telegram Post