File Upload Vulnerability in Optimizely EPiServer CMS
CVE-2025-22389

8HIGH

Key Information:

Vendor

Optimizely

Status
Optimizely Cms
Vendor
CVE Published:
4 January 2025

What is CVE-2025-22389?

In Optimizely EPiServer CMS, a vulnerability exists prior to version 12.32.0 where the application fails to adequately validate uploaded files. This oversight permits the upload of potentially dangerous file types such as .docm and .html. If these files are accessed by users of the application, they may execute harmful actions or lead to system compromises, posing significant security risks for users and organizations relying on this content management system.

References

https://support.optimizely.com/hc/en-us/articles/33182404...

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.