CVE-2025-59872 — MEDIUM (4.3)

Vulnerability Description

HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability, If the server is configured to execute code, then it may be possible to obtain command execution on the server by uploading a file known as a web shell, which allows you to execute arbitrary code or operating system commands. For this attack to be successful, the file needs to be uploaded inside the Webroot, and the server must be configured to execute the code

CVSS Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Hcltech	Zie For Web	16.0

Related Weaknesses (CWE)

CWE-209 CWE-434

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131549Vendor Advisory

FAQ

What is CVE-2025-59872?

CVE-2025-59872 is a vulnerability with a CVSS score of 4.3 (MEDIUM). HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability, If the server is configured to execute code, then it may be possible to obtain command execution on the server by uploading a ...

How severe is CVE-2025-59872?

CVE-2025-59872 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2025-59872?

Check the references section above for vendor advisories and patch information. Affected products include: Hcltech Zie For Web.