File Upload Vulnerability in Omnispace Agora Project Software
CVE-2025-67077

8.8HIGH

Key Information:

Vendor

Omnispace

Status
Agora Project
Vendor
CVE Published:
15 January 2026

What is CVE-2025-67077?

The Omnispace Agora Project is susceptible to a file upload vulnerability that allows authenticated users to exploit the UploadTmpFile action. Under specific circumstances, even guest users can initiate this action, leading to potential unauthorized file uploads. This flaw poses significant security risks, especially if malicious files are uploaded, which may compromise the integrity of the server.

References

https://www.agora-project.net
https://www.helx.io/blog/advisory-agora-project/

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.