CVE-2025-55743: Webkul Unopim Path Traversal Vulnerability

CVE-2025-55743 Overview

CVE-2025-55743 is an unrestricted file upload vulnerability in UnoPim, an open-source Product Information Management (PIM) system built on the Laravel framework. The flaw exists in the image upload component of the user creation feature, which performs file type validation only on the client side. An authenticated attacker can intercept the upload request with a proxy such as Burp Suite, modify the file extension and content, and bypass the validation. The vulnerability affects UnoPim versions prior to 0.2.1 and is tracked under [CWE-434] Unrestricted Upload of File with Dangerous Type.

Critical Impact
Successful exploitation allows an attacker with elevated privileges to upload arbitrary files, potentially leading to server-side code execution and full compromise of confidentiality, integrity, and availability.

Affected Products

Webkul UnoPim versions prior to 0.2.1
Deployments using the user creation image upload feature
Laravel-based UnoPim PIM installations exposed to authenticated users

Discovery Timeline

2025-08-21 - CVE-2025-55743 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55743

Vulnerability Analysis

The vulnerability resides in the user creation workflow of UnoPim. When an administrator creates a new user, the application accepts a profile image upload. The application enforces file type restrictions exclusively in the browser using client-side JavaScript validation. The server does not re-validate the uploaded content or extension.

An attacker who can authenticate with sufficient privileges submits the upload request, intercepts it with an HTTP proxy, and rewrites both the filename extension and the file body. The server stores the file without verifying its MIME type, magic bytes, or extension. This allows storage of executable scripts or other dangerous content within the application's upload directory.

Root Cause

The root cause is missing server-side input validation, classified as [CWE-434]. Client-side checks are advisory and trivially bypassed by any attacker who controls the HTTP request. The UnoPim upload handler trusts the client-supplied content type and filename rather than enforcing an allowlist of permitted extensions and verifying file signatures on the server.

Attack Vector

The attack vector is network-based and requires authenticated access with high privileges, such as an administrator account capable of creating users. The attacker initiates a legitimate image upload, intercepts the request in transit, swaps the payload for a malicious file (for example, a PHP script with a .jpg extension renamed to .php), and forwards the request. Once stored within the web root or an executable directory, the file can be requested via HTTP to trigger execution. The maintainers fixed the issue in UnoPim 0.2.1 by adding server-side validation. See the GitHub Security Advisory GHSA-v22v-xwh7-2vrm for vendor details.

Detection Methods for CVE-2025-55743

Indicators of Compromise

Files with script extensions (.php, .phtml, .phar) in UnoPim upload directories such as storage/app/public/ or user avatar paths
Uploaded files whose magic bytes do not match the declared image MIME type
HTTP POST requests to user creation endpoints containing non-image payloads
Unexpected outbound network connections originating from the UnoPim web server process

Detection Strategies

Inspect upload directories for files whose extensions do not match an image allowlist (.jpg, .jpeg, .png, .gif, .webp)
Review web server access logs for direct GET requests to files inside upload directories with executable extensions
Audit Laravel application logs for user creation events followed by requests to newly written file paths
Deploy web application firewall rules that block requests containing multipart bodies with mismatched Content-Type and filename extensions

Monitoring Recommendations

Enable file integrity monitoring on UnoPim upload directories and alert on any new non-image file
Forward web server, PHP-FPM, and Laravel logs to a centralized logging platform for correlation
Monitor administrative user creation activity and correlate with upload telemetry to identify abuse patterns

How to Mitigate CVE-2025-55743

Immediate Actions Required

Upgrade UnoPim to version 0.2.1 or later, which adds server-side file type validation
Audit all upload directories for files written before the patch and remove any non-image content
Rotate credentials for administrative accounts that could have been used to exploit the flaw
Restrict execution of scripts within upload directories at the web server level

Patch Information

The vulnerability is fixed in UnoPim 0.2.1. The maintainers added server-side validation of file uploads to the user creation feature. Refer to the UnoPim GitHub Security Advisory for upgrade instructions and full details.

Workarounds

Disable the user creation image upload feature until the patched version can be deployed
Configure the web server to deny execution of scripts (.php, .phtml) within upload directories using nginx location rules or Apache <Directory> directives
Place a reverse proxy or WAF in front of UnoPim to inspect multipart uploads and reject requests with mismatched extensions and content types
Limit administrative access to the application to trusted networks via IP allowlisting

bash

# Example nginx configuration to block script execution in UnoPim upload paths
location ~* ^/storage/.*\.(php|phtml|phar|pl|py|sh)$ {
    deny all;
    return 403;
}