CVE-2025-51056
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
An unrestricted file upload vulnerability in Vedo Suite 2024.17 allows remote authenticated attackers to write to arbitrary filesystem paths by exploiting the insecure 'uploadPreviews()' function in '/api_vedo/colorways_preview', ultimately resulting in remote code execution (RCE).
Risk Assessment
The risk for the organization includes full server compromise, potentially leading to data theft, malware installation, or service disruption.
Recommendation
Immediately update Vedo Suite to the latest patched version and implement file type validation and path restrictions in the file upload functionality.
Other vulnerabilities in Vedo Suite
See all- CVE-2026-51366Critical
SQL Injection vulnerability in Bottinelli Informatica Vedo Suite v1.2.5 allows a remote attacker to execute arbitrary code via the api_vedo/chat endpoint and the utente_chat parameter.
- CVE-2026-51367High
An issue in Bottinelli Informatica Vedo Suite v1.2.5 allows a remote attacker to obtain sensitive information via the api_vedo/chat endpoint and the utente_chat parameter.
- CVE-2025-51058Medium
An SSRF vulnerability in Vedo Suite 2024.17 allows authenticated attackers to send HTTP requests to arbitrary external paths via the "file" parameter in the /api_vedo/video/preview endpoint.
- CVE-2025-51057Medium
A local file inclusion (LFI) vulnerability in Vedo Suite version 2024.17 allows remote authenticated attackers to read arbitrary filesystem files by exploiting an unsanitized 'readfile()' function call in '/api_vedo/video/preview'.
- CVE-2025-51055High
Insecure storage of credentials has been found in the /api_vedo/configuration/config.yml file in Vedo Suite version 2024.17. This file contains clear-text credentials, secret keys, and database information.
- CVE-2025-51054Medium
A vulnerability in Vedo Suite 2024.17 allows unauthenticated remote attackers to obtain a valid high-privilege JWT token by sending an empty HTTP POST request to the /autologin/ endpoint, due to incorrect access control.
- CVE-2025-51053Medium
A Cross-site scripting (XSS) vulnerability in /api_vedo/ in Vedo Suite version 2024.17 allows remote attackers to inject arbitrary JavaScript or HTML code, potentially leading to code execution in the victim's browser.
- CVE-2025-51052Medium
A path traversal vulnerability in Vedo Suite 2024.17 allows remote authenticated attackers to read arbitrary filesystem files by exploiting an unsanitized 'file_get_contents()' function call in '/api_vedo/template'.
Original NVD description (English source)
An unrestricted file upload vulnerability in Vedo Suite version 2024.17 allows remote authenticated attackers to write to arbitrary filesystem paths by exploiting the insecure 'uploadPreviews()' custom function in '/api_vedo/colorways_preview', ultimately resulting in remote code execution (RCE).