Skip to content
CVE PROGRAM SOURCE RECORD8.6 High

CVE-2025-10544

Unrestricted uploading of dangerous file types to AvePoint products

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
INCIBE

Description

Unrestricted file upload vulnerability in DocAve 6.13.2, Perimeter 1.12.3, Compliance Guardian 4.7.1, and earlier versions, allowing administrator users to upload files without proper validation. An attacker could exploit this vulnerability by uploading malicious files that compromise the system. In addition, it is vulnerable to Path Traversal, which allows files to be written to arbitrary directories within the web root.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

AvePoint DocAve

Default version status: unaffected

  • 6.13.2affected

AvePoint Perimeter

Default version status: unaffected

  • 1.12.3affected

AvePoint Compliance Guardian

Default version status: unaffected

  • 0 to < 4.7.1affected

References