CVE-2025-63695

Critical

Published: 18/11/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

DzzOffice v2.3.7 and before is vulnerable to Arbitrary File Upload in /dzz/system/ueditor/php/controller.php.

Risk of remote code execution and full application compromise by an attacker.

Update to a patched version and implement file upload validation.

Original NVD description (English source)

DzzOffice v2.3.7 and before is vulnerable to Arbitrary File Upload in /dzz/system/ueditor/php/controller.php.