CVE-2025-34336

🗓️ 19 Nov 2025 16:20:26Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 8 Views🌐 WEB

Unauthenticated file upload in eGovFramework up to version 4.3.1 via image endpoints enables persistent arbitrary content hosting.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2025-34336	19 Nov 202517:40	–	circl
CNNVD	egovframe-common-components 安全漏洞	19 Nov 202500:00	–	cnnvd
Cvelist	CVE-2025-34336 eGovFramework <= 4.3.1 Unauthenticated File Upload via Web Editor Image Upload Endpoints	19 Nov 202516:20	–	cvelist
EUVD	EUVD-2025-198197	19 Nov 202516:20	–	euvd
NVD	CVE-2025-34336	19 Nov 202517:15	–	nvd
Packet Storm	📄 eGovFramework 4.3.1 File Upload / Unauthenticated Encryption Oracle	20 Nov 202500:00	–	packetstorm
Packet Storm	📄 eGovFramework 4.3.1 Arbitrary File Upload	21 Nov 202500:00	–	packetstorm
Positive Technologies	PT-2025-47485	19 Nov 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-34336	20 Nov 202521:37	–	redhatcve
Vulnrichment	CVE-2025-34336 eGovFramework <= 4.3.1 Unauthenticated File Upload via Web Editor Image Upload Endpoints	19 Nov 202516:20	–	vulnrichment

Vulners

Node

egovframework egovframe-common-componentsRange0–4.3.1

[
  {
    "defaultStatus": "unknown",
    "product": "eGovFramework/egovframe-common-components",
    "repo": "https://github.com/eGovFramework/egovframe-common-components",
    "vendor": "eGovFramework/egovframe-common-components",
    "versions": [
      {
        "lessThanOrEqual": "4.3.1",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
vulncheck	www.vulncheck.com/advisories/egovframework-unauthenticated-file-upload-via-web-editor-image-upload-endpoints
pierrekim	www.pierrekim.github.io/advisories/2025-egovframe.txt
egovframe	www.egovframe.go.kr/eng/sub.do
github	www.github.com/eGovFramework/egovframe-common-components
pierrekim	www.pierrekim.github.io/blog/2025-11-20-egovframe-2-vulnerabilities.html

Parameter	Position	Path	Description	CWE
file	request body	/utl/wed/insertImage.do	Unauthenticated file upload via image upload endpoint, allowing attacker to store arbitrary files on server	CWE-434
file	request body	/utl/wed/insertImageCk.do	Unauthenticated file upload via CKEditor image upload endpoint, allowing attacker to store arbitrary files on server	CWE-434

15 Apr 2026 00:35Current

6.7Medium risk

Vulners AI Score6.7

CVSS 46.9

EPSS0.00731

SSVC

CWE-434