PT-2025-42751 · Galaxy Software Services · Vitals Esp Forum Module

Published 2025-10-20 · Updated 2026-01-30 · CVE-2025-31342

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Galaxy Software Services Corporation Vitals ESP Forum Module versions through 1.3

Description An unrestricted upload of file with dangerous type flaw exists in the upload file function. This allows remote authenticated users to execute arbitrary system commands via a malicious file. The issue enables direct command execution and is considered trivial to weaponize.

Recommendations Versions prior to 1.4 should be updated. As a temporary workaround, restrict file uploads to safe file types. Consider disabling the upload file function until a patch is available.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-31342

Affected Products

Vitals Esp Forum Module

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-31342 · Security Note
• https://zuso.ai/advisory · Note
• https://zuso.ai/advisory/za-2025-15 · Note
• https://twitter.com/CVEnew/status/1980187574485361029 · Twitter Post
• https://twitter.com/CveFindCom/status/1980184620143428045 · Twitter Post
• https://t.me/cveNotify/139364 · Telegram Post
• https://t.me/cveNotify/150366 · Telegram Post
• https://t.me/CVEtracker/35297 · Telegram Post
• https://twitter.com/0dayPublishing/status/1980184541932228762 · Twitter Post