PT-2025-29142 · Unknown+1 · Jquery File Upload+2

Metanubix · Published 2025-07-10 · Updated 2025-07-11 · CVE-2025-34100

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: BuilderEngine version 3.5.0

Description: An unrestricted file upload issue exists due to the integration of elFinder 2.0 and the jQuery File Upload plugin. The plugin does not properly validate or restrict file types or locations during upload operations. This allows an attacker to upload a malicious .php file and execute arbitrary PHP code on the server under the context of the web server process. The vulnerability is exposed to unauthenticated users, resulting in full remote code execution.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Missing Authentication

Unrestricted File Upload

Weakness Enumeration

CWE-306

CWE-434

CWE-20

Related Identifiers

BDU:2025-14618

CVE-2025-34100

Affected Products

Builderengine

Elfinder

Jquery File Upload

References · 9

• 🔥 https://exploit-db.com/exploits/40390 · Exploit
• 🔥 https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/builderengine_upload_exec.rb · Exploit
• https://bdu.fstec.ru/vul/2025-14618 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-34100 · Security Note
• https://twitter.com/VulmonFeeds/status/1943446108312654313 · Twitter Post
• https://vulncheck.com/advisories/builder-engine-unauthenticated-arbitrary-file-upload · Note
• https://twitter.com/CveFindCom/status/1943395040031621582 · Twitter Post
• https://support.alertlogic.com/hc/en-us/articles/115004703183-BuilderEngine-Content-Management-System-CMS-elFinder-2-0-Arbitrary-File-Upload · Note
• https://twitter.com/CVEnew/status/1943668199788343741 · Twitter Post