CVE-2025-12352

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-12352

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-12352.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-12352

Published

2025-11-07T05:15:57.163Z

Modified

2026-03-15T22:52:02.634392Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the copypostimage() function in all versions up to, and including, 2.9.20. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. This only impacts sites that have allowurlfopen set to On, the post creation form enabled along with a file upload field for the post

References

Affected packages

Git /

Affected ranges

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-12352.json"