CVE-2025-41714

The upload endpoint insufficiently validates the 'Upload-Key' request header. By supplying path traversal sequences, an authenticated attacker can cause the server to create upload-related artifacts outside the intended storage location. In certain configurations this enables arbitrary file write and may be leveraged to achieve remote code execution.

• CWE-22

• https://certvde.com/de/advisories/VDE-2025-085

Published

Sep 10, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-41709An unauthenticated remote attacker can perform a command inj…9.8
• CVE-2025-4171The WZ Followed Posts – Display what visitors are reading pl…6.4
• CVE-2025-41710An unauthenticated remote attacker may use hardcodes credent…6.5
• CVE-2025-41711An unauthenticated remote attacker can use firmware images t…5.3
• CVE-2025-41712An unauthenticated remote attacker who tricks a user to uplo…6.5
• CVE-2025-41713During a short time frame while the device is booting an una…6.5
• CVE-2025-41715The database for the web application is exposed without auth…9.8
• CVE-2025-41716The web application allows an unauthenticated remote attacke…5.3
• CVE-2025-41717An unauthenticated remote attacker can trick a high privileg…8.8
• CVE-2025-41718A cleartext transmission of sensitive information vulnerabil…7.5
• CVE-2025-41719A low privileged remote attacker can corrupt the webserver u…8.8
• CVE-2025-4172The VerticalResponse Newsletter Widget plugin for WordPress …6.4