CVE-2025-35032 Medical Informatics Engineering Enterprise Health arbitrary file upload
Authenticated users can upload arbitrary files, potentially leading to code execution or data modification in Enterprise Health.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-35032?
CVE-2025-35032 is a medium-severity vulnerability in Medical Informatics Engineering Enterprise Health, published on 29 Sep 2025. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Medical Informatics Engineering Enterprise Health allows authenticated users to upload arbitrary files. The impact of this behavior depends on how files are accessed. This issue is fixed as of 2025-04-08.
Weakness: CWE-434
Which versions are affected by CVE-2025-35032?
It affects 1 product.
Products include Mieweb Enterprise Health.
How do I fix CVE-2025-35032?
No fix has been published for CVE-2025-35032 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-35032 being exploited?
There is no known exploitation of CVE-2025-35032 in the wild and no public exploit code.
Other vulnerabilities in Medical Informatics Engineering Enterprise Health
- CVE-2025-35030 Medical Informatics Engineering Enterprise Health cross site request forgery
- CVE-2025-35033 Medical Informatics Engineering Enterprise Health CSV injection
- CVE-2025-35034 Medical Informatics Engineering Enterprise Health reflected cross site scripting via portlet_user_id
- CVE-2025-35029 Medical Informatics Engineering Enterprise Health stored cross site scripting via Demographic Information page
- CVE-2025-35031 Medical Informatics Engineering Enterprise Health includes session token in debug output
Sources
Also known as GHSA-cfj8-9637-66c4.