Insufficient Upload Key Validation in Vulnerable Software by Vendor

CVE-2025-41714

What is CVE-2025-41714?

This vulnerability arises from insufficient validation of the 'Upload-Key' request header at the upload endpoint, which can be exploited by authenticated attackers. By leveraging path traversal sequences, these attackers can manipulate the server into creating upload-related artifacts outside the designated storage areas. This misconfiguration could lead to arbitrary file writing, potentially allowing the execution of remote code, thereby posing serious risks to the integrity and security of the system.

References