PT-2025-32220 · Unknown · Vedo Suite

Davide Reggiani + 1 · Published 2025-08-06 · Updated 2025-08-07 · CVE-2025-51056

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Vedo Suite version 2024.17

Description An unrestricted file upload issue exists in Vedo Suite version 2024.17. Remote authenticated attackers can write to arbitrary filesystem paths by exploiting the insecure uploadPreviews() custom function in /api vedo/colorways preview, potentially leading to remote code execution (RCE).

Recommendations As a temporary workaround, consider restricting access to the /api vedo/colorways preview API endpoint until a patch is available. Review and modify the uploadPreviews() function to implement proper file upload restrictions and sanitization.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-51056

Affected Products

Vedo Suite

References · 7

• 🔥 https://github.com/jacopoaugelli/vedo-suite-exploits · Exploit
• https://osv.dev/vulnerability/CVE-2025-51056 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-51056 · Security Note
• https://t.me/CVEtracker/29393 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1953257682988646608 · Twitter Post
• http://bottinelli.com · Note
• https://twitter.com/CVEnew/status/1953195915206115569 · Twitter Post