Fortra’s FileCatalyst has an improper access control issue in its Workflow component, allowing unauthenticated users to upload arbitrary files through the order forms page. This vulnerability poses a significant risk as it can lead to unauthorized file uploads, potentially compromising the system’s integrity. Immediate attention is required to mitigate this security flaw.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.2 | CVE-2025-8450 |
Exploitation
To exploit this vulnerability, an attacker can access the order forms page of Fortra’s FileCatalyst without authentication and upload arbitrary files. This can be done by crafting a request that bypasses the access control mechanisms, potentially leading to unauthorized access to sensitive data or system compromise.
Affected Products
- FileCatalyst: A file transfer solution that allows users to send and receive large files efficiently.
Mitigation
To mitigate this vulnerability, it is essential to implement proper access controls on the Workflow component of FileCatalyst. Ensure that only authenticated users can access the order forms page and upload files. Regular security audits and updates should also be conducted to prevent similar issues in the future.