CVE-2025-3518: File upload functionality possible even when disabled
It technically possible for a user to upload a file to a conversation despite the file upload functionality being disabled.
The file upload functionality can be enabled or disabled for specific use cases through configuration. In case the functionality is disabled for at least one use case, the system nevertheless allows files to be uploaded through direct API requests. During the upload file, interception and allowed file type rules are still applied correctly.
If file sharing is generally enabled, this issue is not of concern.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3518?
CVE-2025-3518 is considered a high severity vulnerability due to its potential to allow unauthorized file uploads.
How do I fix CVE-2025-3518?
To fix CVE-2025-3518, ensure that the file upload functionality is correctly configured and disabled where not needed.
Which software versions are affected by CVE-2025-3518?
CVE-2025-3518 affects Unblu Spark versions from 7.0.1 to 7.54.1 and from 8.0.1 to 8.13.1.
Can users still upload files if the feature is disabled in CVE-2025-3518?
Yes, users can still upload files to a conversation even if the file upload feature is disabled, making it a security risk.
What risk does CVE-2025-3518 pose to systems using Unblu Spark?
CVE-2025-3518 poses a risk of unauthorized file uploads, which can lead to potential data breaches or malware infections.