Hcl CVE-2025-55267

The CVSS v3.1 score of 5.7 reflects moderate severity with high integrity impact (I:H) but no confidentiality or availability impact (C:N/A:N), indicating data tampering and malware injection rather than information disclosure or denial of service. The SSVC decision framework input-Exploitation: none, Automatable: no, Technical Impact: partial-provides critical context: no evidence of active exploitation exists, the vulnerability requires user interaction (UI:R) beyond the initial upload, and technical impact is limited to integrity. The EPSS score is not provided in the input, so exploitation probability cannot be benchmarked against industry averages. Authentication requirement (PR:L) significantly reduces real-world risk compared to unauthenticated file upload flaws, as the attacker must first obtain valid credentials. Synthesis: this is a legitimate but contained risk-high-CVSS-but-low-real-risk for organizations with strong access controls, but a priority for those allowing untrusted users authenticated file upload capabilities.

An authenticated user with upload privileges (e.g., a document management user or junior administrator) uploads a PHP, JSP, or ASP script disguised with a benign file extension or MIME type, bypassing client-side validation. The server accepts the file without server-side extension checking and stores it in a web-accessible directory. The attacker then requests the uploaded script via a direct URL, causing the server to parse and execute it. The script runs with the privileges of the web server process, allowing the attacker to read sensitive files, modify application data, or deploy backdoors for persistent access. User interaction is required at the upload stage, but execution is automatic once the file is accessed.