PT-2025-7139 · Q Free · Q-Free Maxtime

Diego Giubertoni + 1 · Published 2025-02-12 · Updated 2025-10-24 · CVE-2025-26350

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Q-Free MaxTime versions less than or equal to 2.11.0

Description: The issue allows an authenticated remote attacker to upload malicious files via crafted HTTP requests due to an unrestricted upload of files with dangerous types in the template file uploads.

Recommendations: For Q-Free MaxTime versions less than or equal to 2.11.0, update to a version greater than 2.11.0 to resolve the issue. As a temporary workaround, consider restricting access to the template file uploads to minimize the risk of exploitation.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-26350

Affected Products

Q-Free Maxtime

References · 5

• https://osv.dev/vulnerability/CVE-2025-26350 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-26350 · Security Note
• https://t.me/cveNotify/140211 · Telegram Post
• https://nozominetworks.com/labs/vulnerability-advisories-cve-2025-26350 · Note
• https://twitter.com/CVEnew/status/1889673454556745893 · Twitter Post