CVE-2025-34336 eGovFramework <= 4.3.1 Unauthenticated File Upload via Web Editor Image Upload Endpoints
Unauthenticated attackers can upload arbitrary files via image endpoints, enabling persistent file hosting and potential content spoofing on affected eGovFramework applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-34336?
CVE-2025-34336 is a medium-severity vulnerability in eGovFramework/egovframe-common-components, published on 19 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
eGovFramework/egovframe-common-components versions up to and including 4.3.1 contain an unauthenticated file upload vulnerability via the /utl/wed/insertImage.do and /utl/wed/insertImageCk.do image upload endpoints. These controllers accept multipart requests without authentication, pass the uploaded content to a shared upload helper, and store the file on the server under a framework-controlled path. The framework then returns a download URL that can be used to retrieve the uploaded content, including an attacker-controlled Content-Type within the limits of the image upload functionality. While a filename extension whitelist is enforced, the attacker fully controls the file contents. The response MIME type used is also attacker-controlled when the file is served up to version < 4.1.2. Since version 4.1.2, it is possible to download any image uploaded with any whitelisted content type. But any file uploaded other than an image will be served with the `application/octet-stream` content type (the content type is no longer controlled by the attacker since version 4.1.2). This enables an unauthenticated attacker to use any affected application as a persistent file hosting service for arbitrary content under the application's origin. KISA/KrCERT has identified this unpatched vulnerability as "KVE-2023-5280."
Weakness: CWE-434
Which versions are affected by CVE-2025-34336?
How do I fix CVE-2025-34336?
No fix has been published for CVE-2025-34336 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-34336 being exploited?
There is no known exploitation of CVE-2025-34336 in the wild and no public exploit code.
Sources
Also known as GHSA-7x97-5m4c-4jvm.