CVE-2025-11320: Wisdom-Education Unrestricted Upload RCE

CVE-2025-11320 Overview

CVE-2025-11320 is an unrestricted file upload vulnerability in zhuimengshaonian wisdom-education versions up to 1.0.4. The flaw resides in the uploadFile function of src/main/java/com/education/core/controller/UploadController.java. Attackers can manipulate the File argument to upload arbitrary files to the server over the network. Public exploit details have been disclosed, increasing the likelihood of opportunistic exploitation against exposed instances. The weakness is categorized under [CWE-284] (Improper Access Control).

Critical Impact

Remote attackers with low privileges can upload arbitrary files to affected wisdom-education deployments, potentially enabling web shell placement and follow-on compromise.

Affected Products

• zhuimengshaonian wisdom-education 1.0.0 through 1.0.4
• Component: UploadController.java (uploadFile function)
• Deployments exposing the upload endpoint to untrusted networks

Discovery Timeline

• 2025-10-06 - CVE-2025-11320 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11320

Vulnerability Analysis

The uploadFile method in UploadController.java accepts a File parameter without enforcing restrictions on file type, extension, MIME type, or destination path. An authenticated user with low privileges can submit crafted multipart requests to place arbitrary content within the application's web-accessible storage. Because the vulnerability is remotely reachable and public proof-of-concept documentation exists in the referenced GitHub CVE repository, operators of exposed instances should treat the issue as actionable. EPSS currently estimates a 0.331% exploitation probability.

Root Cause

The controller lacks server-side validation of uploaded content. It does not verify allowed extensions, sanitize the filename, restrict the write directory, or enforce authorization checks tied to the upload action. This absence of access control aligns with [CWE-284] and permits attackers to store executable server-side content such as JSP files.

Attack Vector

Exploitation occurs over the network against the wisdom-education front-end upload endpoint. The attacker submits a POST request with a malicious file supplied through the File parameter. A successful upload places attacker-controlled content in a location that may be retrievable or executable by the application server. Refer to the vulnerability reproduction notes for technical steps.

No verified exploit code is provided in this advisory. The vulnerability mechanism is described in prose per the referenced disclosure.

Detection Methods for CVE-2025-11320

Indicators of Compromise

• Unexpected files with executable extensions (.jsp, .jspx, .war) appearing in application upload directories.
• HTTP POST requests to the wisdom-education upload endpoint containing non-media file payloads.
• Web server access logs showing subsequent GET requests to newly written files in upload paths.

Detection Strategies

• Inspect application and reverse-proxy logs for multipart uploads referencing the File parameter handled by UploadController.
• Alert on newly created files in upload directories whose extensions fall outside an approved allowlist.
• Correlate low-privilege user sessions with file-write events on the application server filesystem.

Monitoring Recommendations

• Enable file integrity monitoring across web-accessible directories used by wisdom-education.
• Forward web server and Java application logs to a centralized analytics platform for retention and query.
• Track outbound connections from the application host that may indicate post-upload web shell activity.

How to Mitigate CVE-2025-11320

Immediate Actions Required

• Restrict network exposure of the wisdom-education upload endpoint to trusted users only.
• Audit existing upload directories for files with unexpected extensions and remove unauthorized content.
• Review authentication logs to confirm no low-privilege accounts have been abused for uploads.

Patch Information

No vendor patch has been referenced in the enriched CVE data. Users should monitor the VulDB entry #327201 and the project's upstream repository for updates addressing the uploadFile handler.

Workarounds

• Add a web application firewall rule blocking upload requests containing executable file extensions.
• Configure the application server so that files written to the upload directory cannot be executed as scripts.
• Enforce a strict server-side allowlist of MIME types and extensions in front of the uploadFile function via a reverse proxy.

# Example NGINX rule to prevent script execution in upload directories
location ^~ /upload/ {
    types { }
    default_type application/octet-stream;
    location ~ \.(jsp|jspx|war|sh|php)$ {
        return 403;
    }
}