CVE-2025-54962: Malicious File Upload
Published Aug 4, 2025
·Updated
/edit-user in webserver in OpenPLC Runtime 3 through 9cd8f1b allows authenticated users to upload arbitrary files (such as .html or .svg), and these are then publicly accessible under the /static URI.
Affected Software
1 affected component
OpenPLC Runtime>=3<9cd8f1b
Event History
Aug 4, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:15 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-54962?
CVE-2025-54962 is considered to have a high severity due to its ability to allow authenticated users to upload arbitrary files.
2
How do I fix CVE-2025-54962?
To fix CVE-2025-54962, restrict file upload permissions and validate file types before allowing uploads.
3
Who is affected by CVE-2025-54962?
CVE-2025-54962 affects all versions of OpenPLC Runtime from 3 up to 9cd8f1b.
4
What type of vulnerability is CVE-2025-54962?
CVE-2025-54962 is a file upload vulnerability that allows the uploading of arbitrary files.
5
What can attackers do with CVE-2025-54962?
Attackers can exploit CVE-2025-54962 to upload files such as .html or .svg, which can then be accessed publicly.