CVE-2025-13949: ProudMuBai GoFilm Authentication Bypass

CVE-2025-13949 Overview

CVE-2025-13949 is an unrestricted file upload vulnerability in ProudMuBai GoFilm versions 1.0.0 and 1.0.1. The flaw resides in the SingleUpload function of /server/controller/FileController.go. Attackers can manipulate the File argument to upload arbitrary files to the server without adequate validation. The attack is remotely initiated over the network and requires low-level authenticated access. A public exploit exists, according to VulDB. The vendor was contacted about the disclosure but did not respond. The weakness is classified under CWE-284 (Improper Access Control).

Critical Impact

Authenticated remote attackers can upload arbitrary files through the SingleUpload handler, potentially staging web-accessible payloads for follow-on execution or content tampering.

Affected Products

• ProudMuBai GoFilm 1.0.0
• ProudMuBai GoFilm 1.0.1
• Component: /server/controller/FileController.go (SingleUpload function)

Discovery Timeline

• 2025-12-03 - CVE-2025-13949 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13949

Vulnerability Analysis

The vulnerability originates in the SingleUpload handler within /server/controller/FileController.go, a Go-based file upload endpoint. The function accepts the File parameter from an HTTP request without enforcing sufficient restrictions on file type, extension, or content. This design allows an authenticated user to submit files the application should reject. Because uploaded files may be stored in a location reachable by the web server, an attacker can place content that is later served or interpreted by the application. The public disclosure references a proof-of-concept in the GitHub CVE Issue Discussion and the VulDB CVE Threat Report.

Root Cause

The root cause is improper access control on file upload input, tracked as [CWE-284]. The SingleUpload function does not enforce an allow-list of MIME types or extensions, and does not validate file signature bytes. Without server-side filtering, the endpoint accepts arbitrary payloads that the application then persists.

Attack Vector

An attacker with valid low-privilege credentials sends a crafted multipart HTTP POST request to the SingleUpload endpoint. The request supplies a File parameter containing attacker-controlled content. Because the handler skips content validation, the file is written to the upload directory. Depending on server configuration, this can enable defacement, cross-user content injection, or delivery of scripts that subsequent stages could invoke.

No verified exploit code is reproduced here. See the GitHub CVE Issue Discussion for the disclosed proof-of-concept details.

Detection Methods for CVE-2025-13949

Indicators of Compromise

• Unexpected files with executable or script extensions written under the GoFilm upload directory
• HTTP POST requests to the SingleUpload route containing multipart file parameters from low-privileged accounts
• New files in web-accessible paths with mismatched declared MIME type and actual content signature

Detection Strategies

• Inspect application access logs for repeated or anomalous POST requests targeting the SingleUpload endpoint
• Baseline the GoFilm upload directory and alert on writes of file types outside the expected media set
• Correlate upload events with subsequent GET requests to the same file path, which may indicate an attacker verifying payload delivery

Monitoring Recommendations

• Enable audit logging on the upload directory at the filesystem level to capture write events with user context
• Forward web server and application logs to a centralized analytics platform for retention and query
• Alert on requests originating from authenticated sessions that upload files exceeding size or type thresholds defined for normal use

How to Mitigate CVE-2025-13949

Immediate Actions Required

• Restrict network access to GoFilm 1.0.0 and 1.0.1 instances until a vendor patch is available
• Disable or restrict the SingleUpload endpoint at the reverse proxy or web application firewall layer
• Rotate credentials for accounts with upload privileges and audit recent uploads for suspicious files
• Remove execute permissions from the upload directory and ensure the web server does not interpret content there

Patch Information

No vendor patch has been published. According to the disclosure, the vendor was contacted but did not respond. Monitor the VulDB entry and the upstream project for updates. Until a fix is released, apply the compensating controls listed below.

Workarounds

• Enforce an allow-list of file extensions and MIME types in a reverse proxy or WAF rule in front of GoFilm
• Store uploaded files outside the web root and serve them through a controlled handler that sets safe content types
• Rename uploaded files to server-generated identifiers to prevent attacker-controlled paths and extensions
• Validate uploaded content by inspecting file magic bytes rather than trusting client-supplied metadata

# Example NGINX rule to block script execution in an uploads directory
location /uploads/ {
    types { }
    default_type application/octet-stream;
    add_header X-Content-Type-Options nosniff;
    location ~ \.(php|phtml|jsp|asp|aspx|cgi|pl|py|sh|go)$ {
        deny all;
    }
}