PT-2025-41744 · Unknown · Totaljs Flow

Edcarlos · Published 2025-10-13 · Updated 2025-10-13 · CVE-2025-11655

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:L/Au:M/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Total.js Flow versions prior to 673ef9144dd25d4f4fd4fdfda5af27f230198924

Description A security flaw exists in Total.js Flow related to the SVG File Handler component. Manipulation of this component can lead to unrestricted file upload, and the attack can be initiated remotely. The exploit has been publicly released. Continuous delivery with rolling releases is used, and the vendor did not respond to early disclosure attempts.

Recommendations Update to a version later than 673ef9144dd25d4f4fd4fdfda5af27f230198924.

Fix

Improper Access Control

Unrestricted File Upload

Weakness Enumeration

CWE-284

CWE-434

Related Identifiers

CVE-2025-11655

Affected Products

Totaljs Flow

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-11655 · Security Note
• https://twitter.com/VulmonFeeds/status/1977588020715962368 · Twitter Post
• https://vuldb.com/?submit.665479 · Note
• https://vuldb.com/?ctiid.328072 · Note
• https://vuldb.com/?submit.665497 · Note
• https://t.me/CVEtracker/34735 · Telegram Post
• https://twitter.com/CVEnew/status/1977567305484628163 · Twitter Post
• https://t.me/cveNotify/138407 · Telegram Post
• https://vuldb.com/?id.328072 · Note