SecuriTricks - CVE-2025-46080

Description

HuoCMS V3.5.1 has a File Upload Vulnerability. An attacker can exploit this flaw to bypass whitelist restrictions and craft malicious files with specific suffixes, thereby gaining control of the server.

Product(s) Impacted

Vendor	Product	Versions
Huocms	Huocms	3.5.1

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-434

Unrestricted Upload of File with Dangerous Type

The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	huocms	huocms	3.5.1	/	/	/	/	/	/	/

References

https://github.com/yggcwhat/CVE-2025-46080/

https://github.com/yggcwhat/test2/blob/main/README.md

CVSS Score

5.3 / 10

CVSS Data - 3.1

Attack Vector: NETWORK
Attack Complexity: LOW
Privileges Required: NONE
Scope: UNCHANGED
Confidentiality Impact: LOW
Integrity Impact: NONE
Availability Impact: NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

View Vector String

Timeline

Published: May 29, 2025, 2:15 p.m.
Last Modified: May 29, 2025, 3:15 p.m.

Status : Awaiting Analysis

CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.

More info

Source

cve@mitre.org

CVE-2025-46080