{"id":"CVE-2025-14532","state":"PUBLISHED","title":"Remote Code Execution via Unrestricted File Upload in DobryCMS","description":"DobryCMS's upload file functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can result in Remote Code Execution.\n\nThis issue was fixed in versions above 5.0.","publishedAt":"2026-03-02T12:49:05.217Z","updatedAt":"2026-03-02T13:34:55.888Z","severity":{"score":9.3,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","source":"CERT-PL"},"assigner":"CERT-PL","products":["Studio Fabryka DobryCMS"],"affected":[{"vendor":"Studio Fabryka","product":"DobryCMS","defaultStatus":"unaffected","versions":[{"version":"1.0","status":"affected","lessThanOrEqual":"1.*","versionType":"semver"},{"version":"2.0","status":"affected","lessThanOrEqual":"2.*","versionType":"semver"},{"version":"5.0","status":"affected","versionType":"semver"}]}],"references":["https://cert.pl/posts/2026/03/CVE-2025-12462/"],"weaknesses":["CWE-434"],"ingestedAt":"2026-10-29T20:08:31.050Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/14xxx/CVE-2025-14532.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-14532","state":"PUBLISHED","datePublished":"2026-03-02T12:49:05.217Z","dateUpdated":"2026-03-02T13:34:55.888Z","assignerShortName":"CERT-PL","assignerOrgId":"4bb8329e-dd38-46c1-aafb-9bf32bcb93c6","dateReserved":"2025-12-11T10:04:25.964Z"},"containers":{"cna":{"title":"Remote Code Execution via Unrestricted File Upload in DobryCMS","descriptions":[{"lang":"en","value":"DobryCMS's upload file functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can result in Remote Code Execution.\n\nThis issue was fixed in versions above 5.0."}],"affected":[{"vendor":"Studio Fabryka","product":"DobryCMS","defaultStatus":"unaffected","versions":[{"version":"1.0","status":"affected","lessThanOrEqual":"1.*","versionType":"semver"},{"version":"2.0","status":"affected","lessThanOrEqual":"2.*","versionType":"semver"},{"version":"5.0","status":"affected","versionType":"semver"}]}],"references":[{"url":"https://cert.pl/posts/2026/03/CVE-2025-12462/"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":9.3,"baseSeverity":"CRITICAL","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-434","description":"CWE-434 Unrestricted Upload of File with Dangerous Type","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"CERT-PL","orgId":"4bb8329e-dd38-46c1-aafb-9bf32bcb93c6","dateUpdated":"2026-03-02T12:49:05.217Z"},"credits":[{"lang":"en","type":"finder","value":"Dawid Radziński (RED SECURITY)"}],"datePublic":"2026-03-02T10:55:00.000Z","impacts":[{"capecId":"CAPEC-253","descriptions":[{"lang":"en","value":"CAPEC-253 Remote Code Inclusion"}]}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-03-02T13:34:48.057861Z","id":"CVE-2025-14532","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-03-02T13:34:55.888Z"}}]}}}