Arbitrary File Upload in SMG Software's Information Portal
Priority MEDIUM 52CWE-434Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.
Summary
Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SMG Software Information Portal allows Code Injection, Upload a Web Shell to a Web Server, Code Inclusion. This issue affects Information Portal: before 13.06.2025.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0154 75th percentileScored 2026-11-07
Fix Fixed Information Portal (SMG Software): 13.06.2025
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SMG Software | Information Portal | before 13.06.2025 | 13.06.2025 | Patch available | CNA |
- Information Portal VendorSMG Software Affected before 13.06.2025 Fixed in 13.06.2025 Patch available CNA
Remediation
- Fix · CNA Information Portal (SMG Software) Fixed in 13.06.2025
Timeline
- 2026-10-02 Threatist record created from CVE-2025-5243
- 2026-10-03 Alias added: GHSA-c7xc-fv22-2pq3
References
Sources
- CVE-2025-5243 · CVE Program
- CVE-2025-5243 · NVD
- FIRST EPSS
- GHSA-c7xc-fv22-2pq3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences