CVE-2025-12867: Hundred Plus｜EIP Plus - Arbitrary File Uplaod

Published Nov 10, 2025

Updated

EIP Plus developed by Hundred Plus has an Arbitrary File Uplaod vulnerability, allowing privileged remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

Affected Software

1 affected component

Hundred Plus EIP Plus

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade EIP Plus to a version that resolves this vulnerability.
Fixed in RELEASE_240626

Event History

Nov 10, 2025

CVE Published

via MITRE·03:02 AM

Data Sourced

via MITRE·03:02 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·04:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-12867?

CVE-2025-12867 is considered a critical vulnerability due to its potential for arbitrary code execution.

How do I fix CVE-2025-12867?

To fix CVE-2025-12867, ensure that you apply the latest security updates provided by Hundred Plus for EIP Plus.

What type of vulnerability is CVE-2025-12867?

CVE-2025-12867 is classified as an Arbitrary File Upload vulnerability.

Who is affected by CVE-2025-12867?

CVE-2025-12867 affects users of Hundred Plus EIP Plus where the software is improperly configured.

What are the consequences of exploiting CVE-2025-12867?

Exploiting CVE-2025-12867 can lead to remote code execution, allowing attackers to gain unauthorized control over the server.