CVE-2025-0473 - CVE House
Back to Database
Status published Medium CVE-2025-0473

Incomplete Cleanup vulnerability in PMB platform

Vulnerability Description

Vulnerability in the PMB platform that allows an attacker to persist temporary files on the server, affecting versions 4.0.10 and above. This vulnerability exists in the file upload functionality on the ‘/pmb/authorities/import/iimport_authorities’ endpoint. When a file is uploaded via this resource, the server will create a temporary file that will be deleted after the client sends a POST request to ‘/pmb/authorities/import/iimport_authorities’. This workflow is automated by the web client, however an attacker can trap and launch the second POST request to prevent the temporary file from being deleted.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-0473

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Pau Valls Peleteiro

References

More from PMB Services

View All →
CVE-2025-0472
Information exposure vulnerability in PMB platform
High 7.5
CVE-2025-0471
Unrestricted Upload of File with Dangerous Type vulnerability in PMB platform
Critical 9.9
CVE-2024-26289
Remote Code Inclusion Vulnerability in Multiple PMB Versions
Critical 9.8
CVE-2020-36970
PMB 5.6 - 'chemin' Local File Disclosure
Medium 6.9

Affected Vendor

PMB Services

View all reports →

Affected Software

PMB platform
Vulnerable Versions:
4.0.10

Timeline

Official Publish: January 16th, 2025
Last Modified: January 16th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-459

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.