CVE-2025-70457: Malicious File Upload
A Remote Code Execution (RCE) vulnerability exists in Sourcecodester Modern Image Gallery App v1.0 within the gallery/upload.php component. The application fails to properly validate uploaded file contents. Additionally, the application preserves the user-supplied file extension during the save process. This allows an unauthenticated attacker to upload arbitrary PHP code by spoofing the MIME type as an image, leading to full system compromise.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-70457?
CVE-2025-70457 is classified as a Critical severity vulnerability due to its potential for Remote Code Execution.
How do I fix CVE-2025-70457?
To mitigate CVE-2025-70457, ensure proper validation and sanitization of uploaded file types in the gallery/upload.php component.
What type of vulnerability is CVE-2025-70457?
CVE-2025-70457 is a Remote Code Execution (RCE) vulnerability.
Which version of the Sourcecodester Modern Image Gallery App is affected by CVE-2025-70457?
CVE-2025-70457 affects version 1.0 of the Sourcecodester Modern Image Gallery App.
What component is vulnerable in CVE-2025-70457?
The vulnerable component in CVE-2025-70457 is the gallery/upload.php.