CVE-2025-15228

Critical

Published: 29/12/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

BPMFlowWebkit developed by WELLTEND TECHNOLOGY has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

Risk Assessment

An unauthenticated attacker can take control of the server by executing malicious code, potentially leading to breaches of confidentiality, integrity, and availability.

Recommendation

Update BPMFlowWebkit to the latest version or implement protections such as file upload validation and restrict access to upload functionality.

Original NVD description (English source)

BPMFlowWebkit developed by WELLTEND TECHNOLOGY has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.