CVE-2025-31979: medium-severity vulnerability in HCL Software BigFix Service Management (SM)
A File Upload Validation Bypass vulnerability has been identified in the HCL BigFix Service Management (SM)
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.4epss 0.2%
A File Upload Validation Bypass vulnerability has been identified in the HCL BigFix SM, where the application fails to properly enforce file type restrictions during the upload process. An attacker may exploit this flaw to upload malicious or unauthorized files, such as scripts, executables, or web shells, by bypassing client-side or server-side validation mechanisms.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected products
HCL Software · BigFix Service Management (SM)Related CVEs — HCL Software BigFix Service Management (SM)
In the same product, most dangerous first.
CVE-2025-31974LOWHCL BigFix Service Management (SM) is susceptible to a Root File System Not Mounted as Read-OnlyEPSS 0.2%CVE-2025-31976MEDIUMHCL BigFix Service Management (SM) is vulnerable to insufficiently protected credentialsEPSS 0.2%CVE-2025-31982LOWHCL BigFix Service Management (SM) had directories that were not linked or publicly visible but could be accessed directlEPSS 0.2%CVE-2025-31959LOWHCL BigFix Service Management (SM) application fails to strip EXIF metadata from uploaded images.EPSS 0.1%CVE-2025-31978MEDIUMHCL BigFix Service Management (SM) does not adequately sanitize or safely renderEPSS 0.1%CVE-2025-31977MEDIUMA cryptographic weakness has been identified in the HCL BigFix Service Management (SM)EPSS 0.1%