Jquery EUVD-2025-21028

This vulnerability represents critical, real-world risk based on multiple converging signals: (1) CVSS 4.0 vector of 9.3 indicates network-accessible (AV:N), low complexity (AC:L), no authentication (PR:N), no user interaction (UI:N), with high impact across confidentiality, integrity, and availability (VC:H/VI:H/VA:H); (2) Attack surface is maximally exposed—unauthenticated remote attackers can exploit this without any prerequisites; (3) The vulnerability chain is straightforward and highly automatable—file upload + PHP execution requires no sophisticated exploitation logic; (4) While specific EPSS score and KEV/CISA inclusion status are not provided in the available data, the combination of network exploitability, zero authentication, and RCE capability strongly suggest this meets criteria for active exploitation tracking; (5) The vulnerability is not a theoretical edge case but a direct consequence of insecure integration patterns common in file upload implementations. This is a genuinely critical priority requiring immediate patching, not a false-alarm high-CVSS issue.

An unauthenticated attacker identifies a BuilderEngine 3.5.0 instance on the internet (e.g., example.com/builderengine). The attacker crafts an HTTP POST request to the elFinder/jQuery File Upload endpoint (typically at a path like /upload/ or /files/upload) with a malicious PHP file (e.g., shell.php containing <?php system($_GET['cmd']); ?>) disguised or with a double extension (shell.php.jpg) or by exploiting MIME type confusion. Due to lack of server-side validation, the file is uploaded to a web-accessible directory (e.g., /uploads/ or /files/). The attacker then makes a direct HTTP request to http://example.com/uploads/shell.php, triggering PHP execution. The attacker now has arbitrary code execution as the web server user and can read/modify sensitive files, establish reverse shells, pivot to other systems, or establish persistence. The entire exploitation chain requires only publicly-available information (target identification), basic HTTP knowledge, and no special privileges—making this highly attractive for automated exploitation at scale. No user interaction or authentication is required.