PT-2025-29134 · Unknown · Secure-Upload

Published 2025-07-10 · Updated 2025-07-11 · CVE-2025-53709

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Secure-upload versions prior to 0.815.0

Description: Secure-upload is a data submission service that validates single-use tokens when accepting submissions to channels. The service was installed on a limited number of environments. Privileged users could select email templates not intended for their enrollment when submitting data upload requests. Authenticated and privileged users could misuse an endpoint to redirect submission channels to datasets they control. An endpoint responsible for domain validation allowed unauthenticated users to enumerate existing enrollments. Other endpoints allowed enumeration of resources with known RIDs across enrollments.

Recommendations: Update to version 0.815.0 or later.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2025-53709

Affected Products

Secure-Upload

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2025-53709 · Security Note
• https://twitter.com/CVEnew/status/1943700223772987531 · Twitter Post
• https://cwe.mitre.org/data/definitions/285.html · Note