EUVD-2025-209459
GHSA-pw2f-q928-88j2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Client-side uploader type confusion likely needs a victim to process attacker-influenced input, so UI:R and AC:H; info-disclosure and memory-corruption tags support C:H/A:H while integrity impact is unclear (I:N).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
An issue pertaining to CWE-843: Access of Resource Using Incompatible Type was discovered in transloadit uppy v0.25.6.
AnalysisAI
Type-confusion (CWE-843) in Transloadit's Uppy file-uploader library at version 0.25.6 can lead to memory corruption and information disclosure when a resource is accessed using an incompatible type. Published details are minimal, but the assigned CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) asserts remote, unauthenticated impact with total loss of confidentiality, integrity, and availability. There is no public exploit identified and no CISA KEV listing; a referenced GitHub gist may contain a proof-of-concept but its contents are unverified, and the 0.02% EPSS score plus SSVC 'exploitation: none' indicate no observed exploitation to date.
Technical ContextAI
Uppy is a widely used open-source JavaScript file-upload client maintained by Transloadit, typically embedded in web front-ends to handle drag-and-drop uploads, resumable (tus) transfers, and remote-source integrations. The root cause is CWE-843, Access of Resource Using Incompatible Type ('type confusion'), where code accesses a resource assuming one type while it is actually another, causing the runtime to misinterpret object layout or memory. In native code this class enables memory corruption and out-of-bounds reads (consistent with the 'Memory Corruption' and 'Information Disclosure' tags); in a pure-JavaScript library it more often manifests as prototype/type mismatches causing logic errors or data leakage, so the memory-corruption framing here is unusual and may reflect auto-generated or low-fidelity CVE metadata. The CPE is a placeholder (cpe:2.3:a:n/a:n/a:*) and provides no authoritative product/version enumeration.
RemediationAI
No vendor-released patch or fixed version is identified in the available data at time of analysis, and the CVE lists only 0.25.6 (a very old release) as affected. The primary recommended action is to upgrade Uppy to the latest maintained release from https://github.com/transloadit/uppy and review the project changelog/security advisories for a fix referencing CVE-2025-70023; running 0.25.6 in production is strongly discouraged regardless of this issue given its age. As compensating controls until a confirmed fix is available, constrain and validate all data the uploader processes - enforce strict server-side MIME/type and size validation rather than trusting client-side handling, restrict the origins and remote-source integrations Uppy may pull from, and serve the uploader behind a strict Content-Security-Policy to limit the impact of any client-side type confusion; the trade-off is that tightened CSP and source restrictions may break legitimate remote-provider or resumable-upload features and require configuration testing. Consult the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2025-70023) and the referenced gist for any published details or PoC before finalizing mitigations.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today