Skip to main content

Concert CVE-2025-33015

HIGH
Unrestricted Upload of File with Dangerous Type (CWE-434)
2026-01-20 psirt@us.ibm.com
IBM Concert
8.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Mar 12, 2026 - 21:54 vuln.today
CVE Published
Jan 20, 2026 - 16:16 nvd
HIGH 8.8

DescriptionCVE.org

IBM Concert 1.0.0 through 2.1.0 is vulnerable to malicious file upload by not validating the content of the file uploaded to the web interface.

AnalysisAI

Concert versions up to 2.1.0 is affected by unrestricted upload of file with dangerous type (CVSS 8.8).

Technical ContextAI

This vulnerability (CWE-434: Unrestricted Upload of File with Dangerous Type) affects Concert. IBM Concert 1.0.0 through 2.1.0 is vulnerable to malicious file upload by not validating the content of the file uploaded to the web interface.

RemediationAI

Monitor vendor advisories for a patch. Validate file types by content. Store uploads outside web root. Restrict network access to the affected service where possible.

More in Concert

View all
CVE-2025-33088 HIGH
7.4 Feb 17

Concert versions up to 2.1.0 is affected by incorrect permission assignment for critical resource (CVSS 7.4).
CVE-2024-55909 MEDIUM
6.5 May 02

IBM Concert Software 1.0.0 through 1.0.5 could allow an authenticated user to cause a denial of service due to the expan
CVE-2024-55910 MEDIUM
6.5 May 02

IBM Concert Software 1.0.0 through 1.0.5 is vulnerable to server-side request forgery (SSRF). Rated medium severity (CVS
CVE-2024-51451 MEDIUM
6.5 Feb 04

Concert versions up to 2.1.0 contains a vulnerability that allows attackers to conduct various attacks against the vulne
CVE-2025-33089 MEDIUM
6.5 Feb 17

IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information or perform unauthorized ac
CVE-2025-36018 MEDIUM
6.5 Feb 17

IBM Concert 1.0.0 through 2.1.0 for Z hub component is vulnerable to cross-site request forgery which could allow an att
CVE-2024-43181 MEDIUM
6.3 Feb 04

IBM Concert 1.0.0 through 2.1.0 does not invalidate session after logout which could allow an authenticated user to impe
CVE-2025-36019 MEDIUM
6.1 Feb 17

IBM Concert 1.0.0 through 2.1.0 for Z hub framework is vulnerable to cross-site scripting. [CVSS 6.1 MEDIUM]
CVE-2024-55912 MEDIUM
5.9 May 02

IBM Concert Software 1.0.0 through 1.0.5 uses weaker than expected cryptographic algorithms that could allow an attacker
CVE-2025-1722 MEDIUM
5.9 Jan 20

Concert versions up to 2.1.0 contains a vulnerability that allows attackers to a remote attacker to obtain sensitive inf
CVE-2025-1719 MEDIUM
5.9 Jan 20

Concert versions up to 2.1.0 contains a vulnerability that allows attackers to a remote attacker to obtain sensitive inf
CVE-2025-33101 MEDIUM
5.9 Feb 17

Concert versions up to 2.1.0 contains a vulnerability that allows attackers to obtain sensitive information using man in

Same weakness CWE-434 – Unrestricted Upload of File with Dangerous Type

View all
CVE-2016-3088 CRITICAL POC
9.8
CVE-2021-31207 MEDIUM POC
6.6
CVE-2020-36847 CRITICAL POC
9.8
CVE-2023-51409 CRITICAL POC
10.0
CVE-2025-34511 HIGH POC
8.8
CVE-2020-36849 CRITICAL POC
9.8
CVE-2025-7441 CRITICAL POC
9.8
CVE-2025-31324 CRITICAL POC
10.0

Share

CVE-2025-33015 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy