CVE-2025-67079

CRITICAL

Agora-project < 25.10 - Unrestricted File Upload

Title source: rule
STIX 2.1

Description

File upload vulnerability in Omnispace Agora Project before 25.10 allowing attackers to execute code through the MSL engine of the Imagick library via crafted PDF file to the file upload and thumbnail functions.

References (2)

Scores

CVSS v3 9.8
EPSS 0.0010
EPSS Percentile 28.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-434
Status published
Products (1)
agora-project/agora-project < 25.10
Published Jan 15, 2026
Tracked Since Feb 18, 2026