PT-2025-39630 · Unknown+2 · Compliance Guardian+2

Published 2025-09-26 · Updated 2025-09-26 · CVE-2025-10544

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions DocAve versions prior to 6.13.2 Perimeter versions prior to 1.12.3 Compliance Guardian versions prior to 4.7.1

Description The software contains an unrestricted file upload issue that affects administrator users. The issue allows the upload of files without proper validation, potentially leading to system compromise. Additionally, a path traversal issue allows writing files to arbitrary directories within the web root.

Recommendations Update DocAve to version 6.13.2 or later. Update Perimeter to version 1.12.3 or later. Update Compliance Guardian to version 4.7.1 or later.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-10544

Affected Products

Compliance Guardian

Docave

Perimeter

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-10544 · Security Note
• https://t.me/cveNotify/136516 · Telegram Post
• https://twitter.com/offseq/status/1971523225281569274 · Twitter Post
• https://t.me/CVEtracker/33452 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1971573606023942243 · Twitter Post
• https://incibe.es/en/incibe-cert/notices/aviso/unrestricted-uploading-dangerous-file-types-avepoint-products · Note
• https://twitter.com/CVEnew/status/1971539539568058637 · Twitter Post