CVE-2025-3518mediumCWE-284

CVE-2025-3518: fallo de gravedad media en Unblu Spark

File upload functionality possible even when disabled

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Unblu Spark

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.2%
It technically possible for a user to upload a file to a conversation despite the file upload functionality being disabled. The file upload functionality can be enabled or disabled for specific use cases through configuration. In case the functionality is disabled for at least one use case, the system nevertheless allows files to be uploaded through direct API requests. During the upload file, interception and allowed file type rules are still applied correctly. If file sharing is generally enabled, this issue is not of concern.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
Productos afectados
Unblu inc. · Unblu Spark
CVEs relacionadas — Unblu Spark

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-14933HIGHUnblu Spark Cross-Site Scripting in Embedded Co-BrowsingEPSS 0.6%CVE-2026-8152CRITICALUnblu Spark Open Redirect leading to DOM-Based XSSEPSS 0.4%CVE-2026-9589CRITICALUnblu Spark Authorization Bypass in Configuration Cascade OperationsEPSS 0.4%CVE-2025-3519HIGHReplace uploaded files knowing the file upload IDEPSS 0.3%