CVE-2025-66256 - CVE House

Back to Database

Status published Critical CVE-2025-66256

Unauthenticated Arbitrary File Upload (patch_contents.php)

9.9 CVSS

Vulnerability Description

Unauthenticated Arbitrary File Upload (patch_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Unrestricted file upload in patch_contents.php allows uploading malicious files. The `/var/tdf/patch_contents.php` endpoint allows unauthenticated arbitrary file uploads without file type validation, MIME checking, or size restrictions beyond 16MB, enabling attackers to upload malicious files.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-66256

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Abdul Mhanni

References

https://www.abdulmhsblog.com/posts/webfmvulns/

More from DB Electronica Telecomunicazioni S.p.A.

View All →

Unauthenticated Arbitrary File Read via Null Byte Injection

Arbitrary File Overwrite via Tar Extraction Path Traversal

Unauthenticated OS Command Injection (restore_settings.php)

PostgreSQL SQL Injection (status_sql.php)

Authenticated Root Remote Code Execution through improper filtering of HTTP post request parameters

Affected Vendor

DB Electronica Telecomunicazioni S.p.A.

View all reports →

Affected Software

Mozart FM Transmitter

Vulnerable Versions:

30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000

Timeline

Official Publish: November 26th, 2025

Last Modified: December 3rd, 2025

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1505.003 Web Shell

T1105 Ingress Tool Transfer

Command and Control

T1059 Command and Scripting Interpreter

T1565.002 Stored Data Manipulation