Log in Start free

Vulnerability · Published Sep 26, 2025 · Assigned by INCIBE

CVE-2025-10544Unrestricted uploading of dangerous file types to AvePoint products

High 8.6

In plain English

A high-severity unrestricted file upload in Compliance Guardian from AvePoint. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 4.0)8.6High
Exploit odds (30 days)0.3%top 76.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Unrestricted file upload vulnerability in DocAve 6.13.2, Perimeter 1.12.3, Compliance Guardian 4.7.1, and earlier versions, allowing administrator users to upload files without proper validation. An attacker could exploit this vulnerability by uploading malicious files that compromise the system. In addition, it is vulnerable to Path Traversal, which allows files to be written to arbitrary directories within the web root.

Affected products (as reported)

VendorProductVersions
AvePoint DocAve 6.13.2
AvePoint Perimeter 1.12.3
AvePoint Compliance Guardian 0 – before 4.7.1

Weakness: CWE-434 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References