CVE-2025-65844 File upload in n/a
Remote attackers can upload arbitrary files to EverShop, enabling credential theft via fake login panels and disk exhaustion denial-of-service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-65844?
CVE-2025-65844 is a high-severity vulnerability in n/a, published on 2 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
EverShop 2.0.1 allows a remote unauthenticated attacker to upload arbitrary files and create directories via the /api/images endpoint. The endpoint is accessible without authentication by default, and server-side validation of uploaded files is insufficient. This can be abused to upload arbitrary content (including non-image files) which could impersonate user/admin login panels (exfiltrating credentials) and to perform a denial-of-service attack by exhausting disk space.
Weakness: CWE-434
Which versions are affected by CVE-2025-65844?
It affects 1 product.
Products include Evershop Evershop.
How do I fix CVE-2025-65844?
No fix has been published for CVE-2025-65844 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-65844 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-65844 exists.
Other vulnerabilities in n/a
- CVE-2026-28213 EverShop Vulnerable to Arbitrary Customer Account Takeover via Exposure of Password Reset Token in API Response
- CVE-2023-46498 Code execution in evershop
- CVE-2026-25993 EverShop has a Second-Order SQL Injection in URL Rewrite Processing Derived from Category URL Keys
- CVE-2023-46943 EverShop at risk to unauthorized access via weak HMAC secret
- CVE-2023-46496 Directory Traversal in evershop
Sources
Also known as GHSA-c88j-gfxj-293x.