: External Control of File Name or Path vulnerability in TAGFREE X-Free Uploader XFU…
Priority MEDIUM 46CWE-73Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
: External Control of File Name or Path vulnerability in TAGFREE X-Free Uploader XFU allows : Parameter Injection.This issue affects X-Free Uploader: from 1.0.1.0084 before 1.0.1.0085, from 2.0.1.0034 before 2.0.1.0035.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00351 28th percentileScored 2026-11-07
Fix Fixed X-Free Uploader (TAGFREE): 1.0.1.0085, 2.0.1.0035
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| TAGFREE | X-Free Uploader | 1.0.1.0084 to before 1.0.1.0085; 2.0.1.0034 to before 2.0.1.0035 | 1.0.1.0085, 2.0.1.0035 | Patch available | CNA |
- X-Free Uploader VendorTAGFREE Affected 1.0.1.0084 to before 1.0.1.0085; 2.0.1.0034 to before 2.0.1.0035 Fixed in 1.0.1.0085, 2.0.1.0035 Patch available CNA
Remediation
- Fix · CNA X-Free Uploader (TAGFREE) Fixed in 1.0.1.0085, 2.0.1.0035
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
TAGFREE X-Free Uploader 1.0.1.0085, 2.0.1.0035
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2025-21256 Path traversal in TAGFREE X-Free UploaderPriority MEDIUM 44
Timeline
- 2026-10-02 Threatist record created from CVE-2025-29866
- 2026-10-03 Alias added: GHSA-8g6x-jfc6-x2j7
References
More TAGFREE vulnerabilities
- TI-2025-21256 Path traversal in TAGFREE X-Free Uploader CVSS 4.0HIGH 8.7
Sources
- CVE-2025-29866 · CVE Program
- CVE-2025-29866 · NVD
- FIRST EPSS
- GHSA-8g6x-jfc6-x2j7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences