Unrestricted Fileupload
Priority LOW 29CWE-434Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Low · High · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.
Summary
There is a risk of unauthorized file uploads in GT-SoftControl and potential file overwrites due to insufficient validation in the file selection process. This could lead to data integrity issues and unauthorized access by an authenticated privileged user.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00215 11th percentileScored 2026-11-07
Fix Fixed GT-SoftControl (Bizerba SE & Co. KG): 6.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Bizerba SE & Co. KG | GT-SoftControl | 0.0 to before 6.0 | 6.0 | Patch available | CNA |
- GT-SoftControl VendorBizerba SE & Co. KG Affected 0.0 to before 6.0 Fixed in 6.0 Patch available CNA
Remediation
- Fix · CNA GT-SoftControl (Bizerba SE & Co. KG) Fixed in 6.0
Timeline
- 2026-10-02 Threatist record created from CVE-2025-2819
- 2026-10-03 Alias added: GHSA-j6w5-x2v9-vjvh
References
More Bizerba SE & Co. KG vulnerabilities
- TI-2025-05912 Scripts within reports executable on BRAIN2 Server CVSS 3.1CRITICAL 10.0
- TI-2025-05913 BRAIN2 Configuration file for database access not sufficiently secured CVSS 3.1CRITICAL 9.3
- TI-2026-13585 Insecure permission overwrite due to execution of LogPathConfig.exe while installing _connect.BRAIN CVSS 3.1HIGH 7.3
- TI-2026-13584 Insecure permission assignment due to execution of LogPathConfig.exe during setup CVSS 3.1HIGH 7.3
- TI-2025-02464 Denial of service in Bizerba SE & Co. KG Product family GLx and CWx CVSS 3.1MEDIUM 6.5
- TI-2026-80307 Cleartext service account password in BRAIN2 setup log files CVSS 3.1MEDIUM 4.4
Sources
- CVE-2025-2819 · CVE Program
- CVE-2025-2819 · NVD
- FIRST EPSS
- GHSA-j6w5-x2v9-vjvh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences