CVE-2025-22213

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

Inadequate checks in the Media Manager allowed users with "edit" privileges to change file extension to arbitrary extension, including .php and other potentially executable extensions.

Metrics

CVSS 4.0 7.1/10

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Mar 11, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-222144.3Landray EIS 2001 through 2006 allows Message/fi_message_receiver.aspx?replyid= SQL injection.CVE-2025-222154.3VMware Aria Automation contains a server-side request forgery (SSRF) vulnerability. A malicious actor with "Organization Member" access to A CVE-2025-222165.4A UAA configured with multiple identity zones, does not properly validate session information across those zones. A User authenticated agai CVE-2025-222178.6Avi Load Balancer contains an unauthenticated blind SQL Injection vulnerability which was privately reported to VMware. Patches are availabl CVE-2025-222187.7VMware Aria Operations for Logs contains an information disclosure vulnerability. A malicious actor with View Only Admin permissions may be CVE-2025-222199.0VMware Aria Operations for Logs contains a stored cross-site scripting vulnerability. A malicious actor with non-administrative privileges m CVE-2025-22227.8CWE-552: Files or Directories Accessible to External Parties vulnerability over https exists that could leak information and potential privi CVE-2025-222205.4VMware Aria Operations for Logs contains a privilege escalation vulnerability. A malicious actor with non-administrative privileges and netw CVE-2025-222214.8VMware Aria Operation for Logs contains a stored cross-site scripting vulnerability. A malicious actor with admin privileges to VMware Aria CVE-2025-222226.5VMware Aria Operations contains an information disclosure vulnerability. A malicious user with non-administrative privileges may exploit thi CVE-2025-222235.3Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods. This may cause an auth CVE-2025-222248.2VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious ac