Golang
CVE-2025-69828
CRITICAL
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 10.0 — maximum severity. Unauthenticated, network-exploitable, leads to complete server compromise. Management consoles typically have broad network access. |
| Exploit ScenarioDerived | An attacker uploads a web shell to the TMS Management Console without authentication, then uses it to execute commands on the server, pivoting to managed systems. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
TMS Management Console v6.3.7 has a CVSS 10.0 arbitrary file upload vulnerability allowing remote attackers to execute arbitrary code on the server without authentication.
Earlier versions of this analysis (1)
Unauthenticated file upload in TMS Management Console enables full server compromise.
RemediationAI
Apply vendor patches immediately. Restrict network access to the management console.
Affected ProductsAI
TMS Global Software TMS Management Console v6.3.7
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
TMS Global Software TMS Management Console v6.3.7.27386.20250818 has a CWE-434 unrestricted file upload that allows unauthenticated remote attackers to upload and execute arbitrary files on the server.
Know when Golang gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
File Upload vulnerability in TMS Global Software TMS Management Console v.6.3.7.27386.20250818 allows a remote attacker to execute arbitrary code via the Logo upload in /Customer/AddEdit
Executive ViewAI
TMS Global Software's Management Console v.6.3.7.27386.20250818 contains a critical vulnerability allowing unrestricted upload of dangerous file types, potentially enabling complete system compromise. Organizations using this software are at immediate risk of unauthorized code execution and data breach, with no patch currently available from the vendor.
Restrict TMS Management Console access via network segmentation (firewall rules, VPN-only access); implement Web Application Firewall with upload content validation rules; disable file upload feature if not essential to operations; enforce strict file type whitelisting at application level; increase logging and monitoring of upload activities; require multi-factor authentication for all console access; maintain isolated backups of critical data; monitor vendor advisories closely for patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and there
Erugo file-sharing platform up to version 0.2.14 has a CVSS 10.0 path traversal allowing authenticated users to read any
Critical certificate validation bypass in Go crypto/tls during session resumption. If ClientCAs or RootCAs fields are mu
WAGO PFC200 G2 PLC (firmware affected) allows privilege escalation through cookie manipulation. Users can modify cookie
Authentication bypass in WeGIA charitable institution management system before 3.6.5. The adicionar_tipo_docs_atendido.p
CGI path splitting vulnerability in FrankenPHP before 1.11.2 — Unicode characters bypass path validation during CGI proc
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization by
Free5gc NRF 1.4.0 has an authorization bypass in access token generation that allows authenticated users to request toke
Algo 8028 Control Panel version 3.3.3 contains a command injection vulnerability in the fm-data.lua endpoint that allows
Denial of service in PocketBase versions prior to 0.22.48 (0.22.x branch) and 0.23.0 through 0.39.6 (0.23.0+ branch) all
Exploit-DB