Unrestricted File Upload Vulnerability in Galaxy Software Services Vitals ESP Forum Module
CVE-2025-31342

9.3CRITICAL

Key Information:

Vendor

Galaxy Software Services Corporation

Status
Vitals Esp
Vendor
CVE Published:
20 October 2025

What is CVE-2025-31342?

The Vitals ESP Forum Module by Galaxy Software Services Corporation contains a vulnerability that permits remote authenticated users to upload files of a dangerous type. This flaw in the upload file function allows these users to execute arbitrary system commands by leveraging malicious files. Versions prior to 1.3 are affected, highlighting the necessity for timely updates and security measures to mitigate potential exploits.

Affected Version(s)

Vitals ESP 0 <= 1.3

References

https://zuso.ai/advisory
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-31342 : Unrestricted File Upload Vulnerability in Galaxy Software Services Vitals ESP Forum Module