PT-2025-34236 · Unopim · Unopim

Sn1P3Rt3S7 · Published 2025-08-21 · Updated 2025-08-21 · CVE-2025-55743

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: UnoPim versions prior to 0.2.1

Description: The image upload functionality during user creation performs only client-side file type validation. An attacker can modify the file extension and content of an uploaded image to execute arbitrary code on the server. This allows for remote code execution (RCE), potentially leading to full system compromise, access to databases and filesystems, and access to other sensitive devices on the network. The vulnerability is exploitable by any user with the ability to change their profile picture within the dashboard. The vulnerable endpoint is /admin/settings/users/create. The vulnerable parameter is image[].

Recommendations: Versions prior to 0.2.1: Implement server-side extension validation using a whitelist approach, utilizing the endswith() check instead of contains() to prevent bypasses.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-55743

GHSA-V22V-XWH7-2VRM

Affected Products

Unopim

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55743.json · Exploit
• 🔥 https://drive.proton.me/urls/PH1ESMKHMW#4Vxb2KNu3tmn · Exploit
• https://github.com/unopim/unopim/security/advisories/GHSA-v22v-xwh7-2vrm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55743 · Security Note
• https://osv.dev/vulnerability/CVE-2025-55743 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v22v-xwh7-2vrm · Vendor Advisory
• https://github.com/unopim/unopim · Note
• https://twitter.com/CVEnew/status/1958603397898363040 · Twitter Post