CVE-2025-65963
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The Files module for managing files in spaces and user profiles, prior to versions 0.16.11 and 0.17.2, has insufficient authorization checks allowing non-member users to create folders and upload/download files as a ZIP archive in public spaces. Private spaces are not affected.
Risk Assessment
Unauthorized users could modify public space content and download files, potentially leading to data leakage or unauthorized changes.
Recommendation
Update the Files module to version 0.16.11 or 0.17.2 (or later).
Other vulnerabilities in Files
See all- CVE-2025-59026Medium
Malicious content uploaded as a file can be used to execute script code when following attacker-controlled links. This can lead to unintended actions in the context of the user's account, including exfiltration of sensitive information.
- CVE-2025-30186Medium
Malicious content uploaded as a file can be used to execute script code when following attacker-controlled links. This can lead to unintended actions in the context of the user's account, including exfiltration of sensitive information.
- CVE-2025-54790Medium
The Files module in versions 0.16.9 and below lacks logic to prevent exploitation of backend SQL queries without direct output, potentially allowing unauthorized data access. This is fixed in version 0.16.10.
- CVE-2025-54789Medium
The Files module in versions 0.16.9 and below lacks logic to prevent injection of arbitrary JavaScript in the File Move functionality, which can lead to Browser JS code execution in the context of the user's session. This is fixed in version 0.16.10.
Original NVD description (English source)
Files is a module for managing files inside spaces and user profiles. Prior to versions 0.16.11 and 0.17.2, insufficient authorization checks allow non-member users to create new folders, up- and download files as a ZIP archive in public spaces. Private spaces are not affected. This issue has been patched in versions 0.16.11 and 0.17.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS