CVE-2025-67077

High

Published: 15/01/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

Omnispace Agora Project before version 25.10 contains a file upload vulnerability that allows authenticated users, and under certain conditions also guest users, to upload files via the UploadTmpFile action.

Risk Assessment

Unauthorized file upload could lead to malware placement on the server or compromise data integrity.

Recommendation

Update Omnispace Agora to version 25.10 or later. Restrict file upload permissions to trusted users only.

Other vulnerabilities in Omnispace Agora

CVE-2025-67076High
Omnispace Agora Project before version 25.10 contains a directory traversal vulnerability that allows unauthenticated attackers to read files on the system via the misc controller and the ExternalGetFile action. Only files with an extension can be read.

Original NVD description (English source)

File upload vulnerability in Omnispace Agora Project before 25.10 allowing authenticated, or under certain conditions also guest users, via the UploadTmpFile action.