CVE-2025-51056

8.2 highEPSS 0.6%

High (8.2) in vedo suite project vedo suite. EPSS 0.6% chance of exploitation in the next 30 days.

An unrestricted file upload vulnerability in Vedo Suite version 2024.17 allows remote authenticated attackers to write to arbitrary filesystem paths by exploiting the insecure 'uploadPreviews()' custom function in '/api_vedo/colorways_preview', ultimately resulting in remote code execution (RCE).

Severity

CVSS 3.1

8.2 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-31)
CWE: CWE-434
Published: 2025-08-06
Modified: 2026-07-05
Record from: the NVD, synced 2026-10-19

Affected

vedo_suite_project:vedo_suite

References

https://github.com/jacopoaugelli/vedo-suite-exploits
https://github.com/jacopoaugelli/vedo-suite-exploits

Check your stack JSON