CVE-2025-59872: HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability,
HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability, If the server is configured to execute code, then it may be possible to obtain command execution on the server by uploading a file known as a web shell, which allows you to execute arbitrary code or operating system commands. For this attack to be successful, the file needs to be uploaded inside the Webroot, and the server must be configured to execute the code
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Ensure the webroot (document root) cannot execute uploaded files; configure the server so that files placed in the webroot are not treated as executable code (e.g., disable/limit script execution in the upload directory) to prevent web-shell command execution.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59872?
CVE-2025-59872 has a medium severity rating of 4.3.
What systems are affected by CVE-2025-59872?
CVE-2025-59872 affects HCL ZIE for Web software.
How do I fix CVE-2025-59872?
To fix CVE-2025-59872, ensure proper configuration of file upload handling and restrict file types that can be uploaded.
What are the risks associated with CVE-2025-59872?
The primary risk of CVE-2025-59872 is the potential for unauthorized command execution on the server through uploaded malicious files.
Can CVE-2025-59872 lead to system compromise?
Yes, if exploited, CVE-2025-59872 can lead to system compromise by allowing attackers to execute arbitrary code.