CVE-2025-67077: Malicious File Upload
Published Jan 15, 2026
·Updated
File upload vulnerability in Omnispace Agora Project before 25.10 allowing authenticated, or under certain conditions also guest users, via the UploadTmpFile action.
Affected Software
2 affected components
Omnispace Agora Project<25.10
Agora-Project Agora-Project<25.10
Event History
Jan 15, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·04:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-67077?
CVE-2025-67077 is classified as a high severity vulnerability due to its potential for unauthorized file uploads.
2
How do I fix CVE-2025-67077?
To fix CVE-2025-67077, users should upgrade to Omnispace Agora Project version 25.10 or later.
3
Who is affected by CVE-2025-67077?
Authenticated users and certain guest users of Omnispace Agora Project versions prior to 25.10 are affected by CVE-2025-67077.
4
What kind of attacks can CVE-2025-67077 facilitate?
CVE-2025-67077 allows attackers to upload malicious files, potentially leading to remote code execution or data breaches.
5
When was CVE-2025-67077 disclosed?
CVE-2025-67077 was disclosed in 2025 and addresses a serious file upload vulnerability in the Omnispace Agora Project.