1. Home
  2. CVE Database
  3. CVE-2025-3518
MEDIUM · 4.3

CVE-2025-3518

It technically possible for a user to upload a file to a conversation despite the file upload functionality being disabled. The file upload functionality can be enabled or disabled for specific use c...

Vulnerability Description

It technically possible for a user to upload a file to a conversation despite the file upload functionality being disabled. The file upload functionality can be enabled or disabled for specific use cases through configuration. In case the functionality is disabled for at least one use case, the system nevertheless allows files to be uploaded through direct API requests. During the upload file, interception and allowed file type rules are still applied correctly. If file sharing is generally enabled, this issue is not of concern.

CVSS Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
UnbluSpark>= 7.0.1, < 7.54.1

Related Weaknesses (CWE)

CWE-284

References

FAQ

What is CVE-2025-3518?

CVE-2025-3518 is a vulnerability with a CVSS score of 4.3 (MEDIUM). It technically possible for a user to upload a file to a conversation despite the file upload functionality being disabled. The file upload functionality can be enabled or disabled for specific use c...

How severe is CVE-2025-3518?

CVE-2025-3518 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2025-3518?

Check the references section above for vendor advisories and patch information. Affected products include: Unblu Spark.