CVE-2025-55743 UnoPim vulnerable to remote code execution through Arbitrary File upload
Attackers can upload malicious files via the user creation feature due to insufficient server-side validation, leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-55743?
CVE-2025-55743 is a high-severity vulnerability in unopim, published on 21 Aug 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, the image upload at the user creation feature performs only client side file type validation. A user can capture the request by uploading an image, capture the request through a Proxy like Burp suite. Make changes to the file extension and content. The vulnerability is fixed in 0.2.1.
Weakness: CWE-434
Which versions are affected by CVE-2025-55743?
2 open source packages ship an affected version, including unopim/unopim. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
unopim/unopim Packagist | All versions | 0.2.1 |
unopim/unopim Packagist | All versions | 0.2.1 |
Products include Webkul Unopim.
How do I fix CVE-2025-55743?
Upgrade unopim/unopim to 0.2.1 or later.
Is CVE-2025-55743 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-55743 exists.
Other vulnerabilities in unopim
- CVE-2025-55741 unopim/unopim allows unauthorized product deletion via mass-delete endpoint
- CVE-2025-55742 UnoPim Stored XSS via SVG MIME/Sanitizer Bypass
- CVE-2025-55744 UnoPim vulnerable to CSRF on Product edit feature and creation of other types
- CVE-2024-52305 UnoPim Stored XSS : Cookie hijacking through Create User function
- CVE-2024-50637 UnoPim Cross-site Scripting vulnerability
Sources
Also known as GHSA-v22v-xwh7-2vrm.