{"id":"CVE-2025-10544","state":"PUBLISHED","title":"Unrestricted uploading of dangerous file types to AvePoint products","description":"Unrestricted file upload vulnerability in DocAve 6.13.2, Perimeter 1.12.3, Compliance Guardian 4.7.1, and earlier versions, allowing administrator users to upload files without proper validation. An attacker could exploit this vulnerability by uploading malicious files that compromise the system. In addition, it is vulnerable to Path Traversal, which allows files to be written to arbitrary directories within the web root.","publishedAt":"2025-09-26T09:51:12.104Z","updatedAt":"2025-09-26T12:41:19.401Z","severity":{"score":8.6,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"INCIBE"},"assigner":"INCIBE","products":["AvePoint DocAve","AvePoint Perimeter","AvePoint Compliance Guardian"],"affected":[{"vendor":"AvePoint","product":"DocAve","defaultStatus":"unaffected","versions":[{"version":"6.13.2","status":"affected"}]},{"vendor":"AvePoint","product":"Perimeter","defaultStatus":"unaffected","versions":[{"version":"1.12.3","status":"affected"}]},{"vendor":"AvePoint","product":"Compliance Guardian","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.7.1","versionType":"custom"}]}],"references":["https://www.incibe.es/en/incibe-cert/notices/aviso/unrestricted-uploading-dangerous-file-types-avepoint-products"],"weaknesses":["CWE-434"],"ingestedAt":"2026-10-29T20:08:20.985Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/10xxx/CVE-2025-10544.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-10544","state":"PUBLISHED","datePublished":"2025-09-26T09:51:12.104Z","dateUpdated":"2025-09-26T12:41:19.401Z","assignerShortName":"INCIBE","assignerOrgId":"0cbda920-cd7f-484a-8e76-bf7f4b7f4516","dateReserved":"2025-09-16T08:12:48.745Z"},"containers":{"cna":{"title":"Unrestricted uploading of dangerous file types to AvePoint products","descriptions":[{"lang":"en","value":"Unrestricted file upload vulnerability in DocAve 6.13.2, Perimeter 1.12.3, Compliance Guardian 4.7.1, and earlier versions, allowing administrator users to upload files without proper validation. An attacker could exploit this vulnerability by uploading malicious files that compromise the system. In addition, it is vulnerable to Path Traversal, which allows files to be written to arbitrary directories within the web root."}],"affected":[{"vendor":"AvePoint","product":"DocAve","defaultStatus":"unaffected","versions":[{"version":"6.13.2","status":"affected"}]},{"vendor":"AvePoint","product":"Perimeter","defaultStatus":"unaffected","versions":[{"version":"1.12.3","status":"affected"}]},{"vendor":"AvePoint","product":"Compliance Guardian","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.7.1","versionType":"custom"}]}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/unrestricted-uploading-dangerous-file-types-avepoint-products"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.6,"baseSeverity":"HIGH","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-434","description":"CWE-434 Unrestricted Upload of File with Dangerous Type","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"INCIBE","orgId":"0cbda920-cd7f-484a-8e76-bf7f4b7f4516","dateUpdated":"2025-09-26T10:22:44.909Z"},"credits":[{"lang":"en","type":"finder","value":"Chetani Mesa Guzmán"},{"lang":"en","type":"finder","value":"Marcos Díaz Castiñeiras"}],"datePublic":"2025-09-26T09:00:00.000Z","solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Update the affected products to the latest available software versions.<br>"}],"value":"Update the affected products to the latest available software versions."}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-09-26T12:18:17.025323Z","id":"CVE-2025-10544","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-09-26T12:41:19.401Z"}}]}}}