Read the docs
TI-2025-03090 Aliases CVE-2025-3518GHSA-4mxw-7rp7-fhjr

File upload functionality possible even when disabled

Priority LOW 24CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

It technically possible for a user to upload a file to a conversation despite the file upload functionality being disabled. The file upload functionality can be enabled or disabled for specific use cases through configuration. In case the functionality is disabled for at least one use case, the system nevertheless allows files to be uploaded through direct API requests. During the upload file, interception and allowed file type rules are still applied correctly. If file sharing is generally enabled, this issue is not of concern.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00247 16th percentileScored 2026-11-07
Fix Fixed Unblu Spark (Unblu inc.): 7.54.1, 8.13.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Unblu inc.Unblu Spark7.0.0 – 7.53.4; 8.0.0 – 8.12.17.54.1, 8.13.1Patch availableCNA
  • Unblu Spark VendorUnblu inc. Affected 7.0.0 – 7.53.4; 8.0.0 – 8.12.1 Fixed in 7.54.1, 8.13.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:unblu:spark:*:*:*:*:*:*:*:*7.0.1 to before 7.54.1; 8.0.1 to before 8.13.1VulnerableUnblu inc.
  • cpe:2.3:a:unblu:spark:*:*:*:*:*:*:*:* Versions 7.0.1 to before 7.54.1; 8.0.1 to before 8.13.1 Vulnerable ·Unblu inc.

Remediation

  • Fix · CNA Unblu Spark (Unblu inc.) Fixed in 7.54.1, 8.13.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-3518
  2. 2026-10-03 Alias added: GHSA-4mxw-7rp7-fhjr

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences