Paper/Archive/CVE-2025-14532

CVE-2025-14532

Studio Fabryka DobryCMS — Remote Code Execution via Unrestricted File Upload in DobryCMS

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 49.9.499 × 2010.0 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

DobryCMS's upload file functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can result in Remote Code Execution. This issue was fixed in versions above 5.0.

Affected

ProductAffectedFixed inSource

DobryCMS1.0 – 1.*–CNA

DobryCMS2.0 – 2.*–CNA

DobryCMS5.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CERT-PL (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcert.pl/posts/2026/03/CVE-2025-12462