Read the docs
TI-2025-24256 Aliases CVE-2025-34096GHSA-j62r-9gm4-h7vx

Easy File Sharing HTTP Server 7.2 Buffer Overflow via POST to /sendemail.ghp

Priority HIGH 81CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

A stack-based buffer overflow vulnerability exists in Easy File Sharing HTTP Server version 7.2. The flaw is triggered when a crafted POST request is sent to the /sendemail.ghp endpoint containing an overly long Email parameter. The application fails to properly validate the length of this field, resulting in a memory corruption condition. An unauthenticated remote attacker can exploit this to execute arbitrary code with the privileges of the server process.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01801 78th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
EFS SoftwareEasy File Sharing HTTP Server7.2—No fix listedCNA
  • Easy File Sharing HTTP Server VendorEFS Software Affected 7.2 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-34096
  2. 2026-10-03 Alias added: GHSA-j62r-9gm4-h7vx

References

Exploit 2

Advisory 1

  • TI-2006-03828 Stack-based buffer overflow in EFS Software Easy File Sharing FTP Server 2.0 allows… CVSS 2.0HIGH 7.5
  • TI-2004-02336 chat.ghp in Easy Chat Server 1.2 allows remote attackers to cause a denial of service… CVSS 2.0MEDIUM 5.0
  • TI-2023-04147 Easy Chat Server Stack-based buffer overflow vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2023-04144 Easy Address Book Web Server Buffer overflow vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2006-01126 Format string vulnerability in Easy File Sharing (EFS) Web Server 3.2 allows remote… CVSS 2.0HIGH 7.8
  • TI-2006-06676 Easy Chat Server 2.1 stores sensitive information under the web root with insufficient… CVSS 2.0HIGH 7.8
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences