Arbitrary File Upload in Podinfo Versions Affected by Security Oversight
CVE-2025-70849
6.1MEDIUM
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2025-70849?
Podinfo versions up to 6.9.0 are susceptible to an arbitrary file upload vulnerability due to improper validation in the /store endpoint. This allows attackers to upload malicious files through crafted POST requests. The lack of a restrictive Content-Security-Policy (CSP) and inadequate Content-Type validation further exposes the application to Stored Cross-Site Scripting (XSS) attacks, compromising the security and integrity of user data.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.