CVE-2025-3518

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

It technically possible for a user to upload a file to a conversation despite the file upload functionality being disabled.

The file upload functionality can be enabled or disabled for specific use cases through configuration. In case the functionality is disabled for at least one use case, the system nevertheless allows files to be uploaded through direct API requests. During the upload file, interception and allowed file type rules are still applied correctly.

If file sharing is generally enabled, this issue is not of concern.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Apr 22, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-35197.0An authorization bypass in Unblu Spark allows a participant of a conversation to replace an existing, uploaded file. Every uploaded file in CVE-2025-35208.1The Avatar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in a function in all versi CVE-2025-35216.4The Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder plugin for WordPress is vulnerable to Stored Cr CVE-2025-35226.3Thunderbird processes the X-Mozilla-External-Attachment-URL header to handle attachments which can be hosted externally. When an email is op CVE-2025-35236.4When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is show CVE-2025-35256.5GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.0 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 tha CVE-2025-35267.5SessionClicks in Liferay Portal 7.0.0 through 7.4.3.21, and Liferay DXP 7.4 GA through update 9, 7.3 GA through update 25, and older unsuppo CVE-2025-35275.4The EventON Pro plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'assets/lib CVE-2025-35288.2A flaw was found in the Mirror Registry. The quay-app container shipped as part of the Mirror Registry for OpenShift has write access to the CVE-2025-35298.2The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including CVE-2025-35307.5The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to product price manipulation in all versions up to, and including, 5.CVE-2025-35316.1A vulnerability classified as problematic has been found in YouDianCMS 9.5.21. This affects an unknown part of the file /App/Tpl/Admin/Defau