CVE-2025-34100

CRITICAL

BuilderEngine 3.5.0 RCE via Unauthenticated Arbitrary File Upload

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-34100 has a selected CVSS score of 9.3 (critical); EIP currently links 2 catalogued exploits.

Description

An unrestricted file upload vulnerability exists in BuilderEngine 3.5.0 via the integration of the elFinder 2.0 file manager and its use of the jQuery File Upload plugin. The plugin fails to properly validate or restrict file types or locations during upload operations, allowing an attacker to upload a malicious .php file and subsequently execute arbitrary PHP code on the server under the context of the web server process. While the root vulnerability lies within the jQuery File Upload component, BuilderEngine’s improper integration and lack of access controls expose this functionality to unauthenticated users, resulting in full remote code execution.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
2

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 11, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

CMS

Browse BuilderEngine / CMS

Default status: unknown

CVE List3.5.0affected

Proofs of concept

2

Catalogued exploits

ExploitDBBuilderEngine 3.5.0 - Arbitrary File UploadExploitDB exploitby metanubixNot analyzed1 file
ExploitDB
PoC details
MetasploitBuilderEngine Arbitrary File Upload Vulnerability and executionMetasploit exploitby Marco Rivoli +1 moreNot analyzed1 file

Ruby

Metasploit
PoC details

References

5