CVE-2025-33015
HighSummary
IBM Concert versions 1.0.0 through 2.1.0 is vulnerable to malicious file upload due to lack of content validation for files uploaded to the web interface. An attacker could exploit this to upload harmful files.
Risk Assessment
The risk involves the possibility of uploading malicious files, which could lead to system integrity compromise, unauthorized code execution, or further environment compromise.
Recommendation
It is recommended to immediately update IBM Concert to the latest available version that includes a fix. Additionally, implement content validation for uploaded files at the application or firewall level.
Other vulnerabilities in IBM Concert
See all- CVE-2026-3627Critical
IBM Concert versions 1.0.0 through 2.3.1 are vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, potentially allowing viewing, adding, modifying, or deleting information in the back-end database.
- CVE-2025-64649Medium
IBM Concert versions 1.0.0 through 2.3.1 may allow a remote attacker to perform unauthorized actions using man-in-the-middle techniques due to improper certificate validation.
- CVE-2025-13044Medium
IBM Concert versions 1.0.0 through 2.2.0 creates temporary files with predictable names. A local user can exploit a symlink attack to overwrite arbitrary files.
Original NVD description (English source)
IBM Concert 1.0.0 through 2.1.0 is vulnerable to malicious file upload by not validating the content of the file uploaded to the web interface.