CVE-2025-3518 - CVE House
Back to Database
Status published Medium CVE-2025-3518

File upload functionality possible even when disabled

Vulnerability Description

It technically possible for a user to upload a file to a conversation despite the file upload functionality being disabled. The file upload functionality can be enabled or disabled for specific use cases through configuration. In case the functionality is disabled for at least one use case, the system nevertheless allows files to be uploaded through direct API requests. During the upload file, interception and allowed file type rules are still applied correctly. If file sharing is generally enabled, this issue is not of concern.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-3518

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Andrei Dabrakou of Citadelo (andrei.dabrakou@citadelo.com)

References

More from Unblu inc.

View All →
CVE-2025-3519
Replace uploaded files knowing the file upload ID
High 7

Affected Vendor

Affected Software

Unblu Spark
Vulnerable Versions:
7.54.1, 8.13.1, 7.0.0, 8.0.0

Timeline

Official Publish: April 22nd, 2025
Last Modified: April 24th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.