PT-2026-3022 · Unknown · Omnispace Agora Project

Published 2026-01-15 · Updated 2026-01-21 · CVE-2025-67077

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Omnispace Agora Project versions prior to 25.10

Description A file upload issue exists in the Omnispace Agora Project. The issue allows authenticated users, and potentially guest users under certain conditions, to upload files via the UploadTmpFile action.

Recommendations Update to version 25.10 or later.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-67077

Affected Products

Omnispace Agora Project

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-67077 · Security Note
• https://osv.dev/vulnerability/CVE-2025-67077 · Vendor Advisory
• https://t.me/cveNotify/149385 · Telegram Post
• https://twitter.com/TheHackerWire/status/2012716907510591522 · Twitter Post
• https://helx.io/blog/advisory-agora-project · Note
• https://twitter.com/CVEnew/status/2012490386913079587 · Twitter Post
• https://agora-project.net · Note
• https://twitter.com/VulmonFeeds/status/2011851376779735281 · Twitter Post
• https://twitter.com/transilienceai/status/2012729476715569462 · Twitter Post