Vulnerability · Published Apr 22, 2025 · Assigned by NCSC.ch
CVE-2025-3518File upload functionality possible even when disabled
Medium 5.3
In plain English
A medium-severity improper access control in Unblu Spark from Unblu inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Official description
It technically possible for a user to upload a file to a conversation despite the file upload functionality being disabled. The file upload functionality can be enabled or disabled for specific use cases through configuration. In case the functionality is disabled for at least one use case, the system nevertheless allows files to be uploaded through direct API requests. During the upload file, interception and allowed file type rules are still applied correctly. If file sharing is generally enabled, this issue is not of concern.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unblu inc. | Unblu Spark | 7.0.0 – through 7.53.48.0.0 – through 8.12.1 |
Weakness: CWE-284 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N