CVE-2025-10763: Academico-SIS RCE Vulnerability

CVE-2025-10763 Overview

CVE-2025-10763 is an unrestricted file upload vulnerability in the academico-sis academico student information system. The flaw resides in the /edit-photo endpoint of the Profile Picture Handler component. An authenticated remote attacker can abuse this endpoint to upload files without proper type or content validation. The issue is tracked under CWE-284: Improper Access Control and affects the codebase up to commit d9a9e2636fbf7e5845ee086bcb03ca62faceb6ab. The project follows a rolling release model, and the vendor did not respond to disclosure attempts. A public exploit proof-of-concept exists.

Critical Impact
Authenticated attackers can upload arbitrary files through the profile picture handler, potentially enabling malicious content delivery or further compromise of the academico application.

Affected Products

academico-sis academico up to commit d9a9e2636fbf7e5845ee086bcb03ca62faceb6ab
Product uses a rolling release strategy with continuous delivery
No fixed version identified by the vendor

Discovery Timeline

2025-09-21 - CVE-2025-10763 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10763

Vulnerability Analysis

The vulnerability exists in the /edit-photo route that handles user profile picture uploads. The handler accepts uploaded files without enforcing sufficient restrictions on file type, extension, or content. This class of flaw maps to CWE-284: Improper Access Control because the upload interface fails to constrain what data an authenticated user may write into the application's storage path.

An attacker with a valid low-privilege account can submit crafted requests to the endpoint. Depending on how the application serves stored profile pictures, the uploaded content may be retrieved by other users or processed by downstream components. Public proof-of-concept material is available in the GitHub Gist code example and VulDB entry #325118.

Root Cause

The root cause is missing or insufficient validation on user-supplied uploads in the Profile Picture Handler. The endpoint does not enforce an allowlist of permitted MIME types or extensions and does not verify that submitted content is a valid image. Access control on the upload sink is inadequate, allowing files outside the intended scope of a profile photo.

Attack Vector

Exploitation requires network access and authenticated (low-privilege) session context, with no user interaction. The attacker sends a crafted HTTP POST request to /edit-photo containing a file payload that would normally be rejected. Because the vendor operates under a rolling release model and did not respond to disclosure, no coordinated patch is documented in the CVE record.

See the VulDB submission and the VulDB critical threat information for additional exploitation context.

Detection Methods for CVE-2025-10763

Indicators of Compromise

Unexpected files with non-image extensions (.php, .phtml, .html, .svg, .js) in the profile picture storage directory
HTTP POST requests to /edit-photo with Content-Type values inconsistent with image uploads
Profile picture files whose size or magic bytes do not match declared image MIME types
Repeated /edit-photo requests from a single authenticated session within a short window

Detection Strategies

Inspect web server access logs for POST requests to /edit-photo and correlate with the account identifier and stored filename
Scan the profile picture upload directory for files whose extensions or magic bytes deviate from expected image formats (JPEG, PNG, GIF)
Alert on subsequent GET requests that retrieve uploaded profile assets with executable or scriptable extensions

Monitoring Recommendations

Enable file integrity monitoring on the upload storage path used by academico
Forward web server and application logs to a centralized analytics platform for retention and correlation
Track authenticated user accounts that exhibit anomalous upload frequency or file size distributions

How to Mitigate CVE-2025-10763

Immediate Actions Required

Restrict access to the academico application to trusted networks or VPN users until a fix is deployed
Audit the profile picture storage directory for suspicious files and remove any content that is not a valid image
Rotate credentials for accounts that show unexpected /edit-photo activity
Deploy a web application firewall (WAF) rule to block non-image Content-Type submissions to /edit-photo

Patch Information

The academico project uses a rolling release strategy, and the vendor did not respond to the disclosure. No specific patched commit has been published in the CVE record. Operators should monitor the academico-sis academico repository for upstream fixes and pin deployments to a reviewed commit hash.

Workarounds

Enforce a strict allowlist of image extensions and MIME types at the reverse proxy or WAF layer
Store uploaded profile pictures on a non-executable path and serve them through a handler that sets Content-Disposition: attachment for unexpected types
Rewrite uploaded images server-side (for example, re-encode via an imaging library) to strip embedded payloads
Revoke upload capability for accounts that do not require profile picture management

bash

# Example nginx configuration to block script execution in the uploads path
location ^~ /storage/profile_pictures/ {
    default_type application/octet-stream;
    location ~* \.(php|phtml|phar|pl|py|jsp|asp|sh|cgi|html?|svg|js)$ {
        return 403;
    }
}