CVE-2025-66480

Wildfire IM is an instant messaging and real-time audio/video solution. Prior to 1.4.3, a critical vulnerability exists in the im-server component related to the file upload functionality found in com.xiaoleilu.loServer.action.UploadFileAction. The application exposes an endpoint (/fs) that handles multipart file uploads but fails to properly sanitize the filename provided by the user. Specifically, the writeFileUploadData method directly concatenates the configured storage directory with the filename extracted from the upload request without stripping directory traversal sequences (e.g., ../../). This vulnerability allows an attacker to write arbitrary files to any location on the server's filesystem where the application process has write permissions. By uploading malicious files (such as scripts, executables, or overwriting configuration files like authorized_keys or cron jobs), an attacker can achieve Remote Code Execution (RCE) and completely compromise the server. This vulnerability is fixed in 1.4.3.

• CWE-22
• CWE-434
• CWE-22

• https://github.com/wildfirechat/im-server/commit/2f9c4e028c01c64913cab32e7248bcca183a5230Patch
• https://github.com/wildfirechat/im-server/releases/tag/1.4.3Release Notes
• https://github.com/wildfirechat/im-server/security/advisories/GHSA-74hq-jhx2-fq6cVendor Advisory

Published

Feb 2, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-66473XWiki is an open-source wiki software platform. Versions 16.…7.5
• CVE-2025-66474XWiki Rendering is a generic rendering system that converts …8.8
• CVE-2025-66476Vim is an open source, command line text editor. Prior to ve…7.8
• CVE-2025-66478Rejected reason: This CVE is a duplicate of CVE-2025-55182.
• CVE-2025-66479Anthropic Sandbox Runtime is a lightweight sandboxing tool f…1.8
• CVE-2025-6648PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Infor…3.3
• CVE-2025-66481DeepChat is an open-source AI chat platform that supports cl…9.6
• CVE-2025-66482Misskey is an open source, federated social media platform. …6.5
• CVE-2025-66483IBM Aspera Shares 1.9.9 through 1.11.0 does not invalidate s…6.5
• CVE-2025-66484IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to stor…5.4
• CVE-2025-66485IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to HTTP…5.4
• CVE-2025-66486IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to HTML…6.1