CVE-2025-65844

{
  "id": "CVE-2025-65844",
  "sourceIdentifier": "[email protected]",
  "published": "2025-12-02T18:15:49.243",
  "lastModified": "2026-11-04T23:10:00.223",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "EverShop 2.0.1 allows a remote unauthenticated attacker to upload arbitrary files and create directories via the /api/images endpoint. The endpoint is accessible without authentication by default, and server-side validation of uploaded files is insufficient. This can be abused to upload arbitrary content (including non-image files) which could impersonate user/admin login panels (exfiltrating credentials) and to perform a denial-of-service attack by exhausting disk space."
    },
    {
      "lang": "es",
      "value": "EverShop 2.0.1 permite a un atacante remoto no autenticado subir archivos arbitrarios y crear directorios a través del endpoint /api/images. El endpoint es accesible sin autenticación por defecto, y la validación del lado del servidor de los archivos subidos es insuficiente. Esto puede ser explotado para subir contenido arbitrario (incluyendo archivos que no son imágenes) que podría suplantar paneles de inicio de sesión de usuario/administrador (exfiltrando credenciales) y para realizar un ataque de denegación de servicio agotando el espacio en disco."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-12-03T15:06:13.942994Z",
          "id": "CVE-2025-65844",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:evershop:evershop:2.0.1:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "2D3A8F90-D61A-4B77-9A57-001AB1BA08DF"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/evershopcommerce/evershop/issues/819",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Vendor Advisory"
      ]
    }
  ]
}