CVE-2025-26350: medium-severity vulnerability in Q-Free MaxTime
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Q-Free MaxTime allows authenticated users to upload malicious files without proper restrictions, potentially leading to code execution or system compromise. This happens because the application doesn't adequately validate file types during template uploads.
CWE-434 unrestricted file upload vulnerability in Q-Free MaxTime ≤2.11.0 template upload functionality allows authenticated attackers to bypass file type validation via crafted HTTP requests, enabling arbitrary file upload and potential remote code execution depending on web server configuration and file handling mechanisms.
In the same product, most dangerous first.