Unrestricted Upload Vulnerability in baowzh hfly by Baowzh
CVE-2025-14522

5.3MEDIUM

Key Information:

Vendor

Baowzh

Status
Hfly
Vendor
CVE Published:
11 December 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-14522?

A severe vulnerability has been identified in the hfly product by Baowzh, specifically impacting the upload_json.php file. This flaw allows attackers to manipulate the imgFile parameter, enabling them to upload files without any restrictions. As the vulnerability can be exploited remotely, it poses a significant risk to the integrity and security of systems using affected versions. The vendor's lack of response to initial disclosures raises concerns regarding the timeline of potential fixes and patches for users.

Affected Version(s)

hfly 638ff9abe9078bc977c132b37acbe1900b63491c

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-14522 - Proof of Concept

References

https://vuldb.com/?id.335860
vdb-entrytechnical-description
https://vuldb.com/?ctiid.335860
signaturepermissions-required
https://vuldb.com/?submit.702950
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

webray.com.cn (VulDB User)
JSON
.
CVE-2025-14522 : Unrestricted Upload Vulnerability in baowzh hfly by Baowzh