Vulnerability · Published Sep 10, 2025 · Assigned by CERTVDE
CVE-2025-41714Path Traversal via 'Upload-Key' in SmartEMS Upload Handling
High 8.8
In plain English
A high-severity path traversal in SmartEMS Web Application from Welotec. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.7%top 46.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The upload endpoint insufficiently validates the 'Upload-Key' request header. By supplying path traversal sequences, an authenticated attacker can cause the server to create upload-related artifacts outside the intended storage location. In certain configurations this enables arbitrary file write and may be leveraged to achieve remote code execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Welotec | SmartEMS Web Application | v0.0.0 – before v3.3.6 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H