CVE-2025-65806

{
  "id": "CVE-2025-65806",
  "sourceIdentifier": "[email protected]",
  "published": "2025-12-04T20:16:19.563",
  "lastModified": "2026-11-04T22:10:00.210",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The E-POINT CMS eagle.gsam-1169.1 file upload feature improperly handles nested archive files. An attacker can upload a nested ZIP (a ZIP containing another ZIP) where the inner archive contains an executable file (e.g. webshell.php). When the application extracts the uploaded archives, the executable may be extracted into a web-accessible directory. This can lead to remote code execution (RCE), data disclosure, account compromise, or further system compromise depending on the web server/process privileges. The issue arises from insufficient validation of archive contents and inadequate restrictions on extraction targets."
    },
    {
      "lang": "es",
      "value": "La función de carga de archivos de E-POINT CMS eagle.gsam-1169.1 maneja incorrectamente los archivos anidados. Un atacante puede cargar un ZIP anidado (un ZIP que contiene otro ZIP) donde el archivo interno contiene un archivo ejecutable (por ejemplo, webshell.php). Cuando la aplicación extrae los archivos cargados, el ejecutable puede ser extraído en un directorio accesible por web. Esto puede llevar a la ejecución remota de código (RCE), divulgación de datos, compromiso de cuentas o compromiso adicional del sistema, dependiendo de los privilegios del servidor web/proceso. El problema surge de una validación insuficiente del contenido del archivo y restricciones inadecuadas en los objetivos de extracción."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 0.9,
        "impactScore": 3.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-12-08T15:39:03.640942Z",
          "id": "CVE-2025-65806",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:e-point:e-point_cms:eagle.gsam-1169.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "441FDDBE-448F-4B80-B5FF-8585BF118A25"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/Bidon47/CVE-2025-65806/blob/main/CVE-2025-65806.md",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://www.e-point.pl/produkty/e-point-cms",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    }
  ]
}