CVE-2025-63994: Psolom Richfilemanager RCE Vulnerability

CVE-2025-63994 Overview

An arbitrary file upload vulnerability exists in the /php/UploadHandler.php component of RichFilemanager v2.7.6. This security flaw allows remote attackers to execute arbitrary code on vulnerable systems by uploading specially crafted malicious files. The vulnerability stems from improper validation of uploaded file types, enabling threat actors to bypass security controls and potentially achieve full system compromise.

Critical Impact

Remote attackers can upload and execute malicious files without authentication, potentially leading to complete server compromise, data exfiltration, and lateral movement within the network.

Affected Products

• Psolom RichFilemanager version 2.7.6

Discovery Timeline

• 2025-11-18 - CVE-2025-63994 published to NVD
• 2025-12-31 - Last updated in NVD database

Technical Details for CVE-2025-63994

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The affected component, /php/UploadHandler.php, fails to properly validate or restrict the types of files that can be uploaded through the RichFilemanager interface. This design flaw allows attackers to upload executable files such as PHP web shells or other malicious scripts that can then be accessed and executed directly through the web server.

The network-accessible attack vector means exploitation can occur remotely without requiring prior authentication or user interaction. Once a malicious file is successfully uploaded, an attacker can trigger its execution by directly accessing the uploaded file through the web server, effectively gaining code execution capabilities on the target system.

Root Cause

The root cause of this vulnerability lies in insufficient file upload validation within the UploadHandler.php component. The application fails to implement proper checks to verify that uploaded files are safe and conform to allowed file types. Key deficiencies include:

• Lack of proper MIME type validation
• Insufficient file extension filtering
• Missing server-side content inspection
• Absence of upload directory execution restrictions

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying a target system running RichFilemanager v2.7.6
2. Crafting a malicious file (such as a PHP web shell) designed to bypass any client-side restrictions
3. Uploading the malicious file through the /php/UploadHandler.php endpoint
4. Accessing the uploaded file directly to trigger code execution
5. Leveraging the achieved access for further malicious activities such as data theft, privilege escalation, or establishing persistence

For technical details regarding this vulnerability, refer to the GitHub Issue Discussion.

Detection Methods for CVE-2025-63994

Indicators of Compromise

• Unexpected files with executable extensions (.php, .phtml, .phar) appearing in upload directories
• Web server access logs showing requests to /php/UploadHandler.php followed by requests to newly created files
• Unusual outbound network connections originating from the web server process
• Modified or newly created PHP files in web-accessible directories

Detection Strategies

• Monitor file upload activity to the /php/UploadHandler.php endpoint for suspicious file types
• Implement file integrity monitoring on web application directories to detect unauthorized file creation
• Configure web application firewalls (WAF) to detect and block requests containing common web shell signatures
• Analyze web server access logs for patterns indicative of file upload attacks followed by shell access

Monitoring Recommendations

• Enable detailed logging for file upload operations and review logs regularly
• Implement real-time alerting for the creation of new executable files in upload directories
• Deploy endpoint detection and response (EDR) solutions to identify post-exploitation activities
• Configure intrusion detection systems to monitor for known web shell communication patterns

How to Mitigate CVE-2025-63994

Immediate Actions Required

• Remove or restrict access to RichFilemanager v2.7.6 until a patch is available
• Implement strict file upload validation at the web server level to block executable file types
• Configure the web server to deny execution of scripts in upload directories
• Review upload directories for any suspicious or malicious files that may have already been uploaded

Patch Information

As of the last update to this CVE (2025-12-31), no official vendor patch has been confirmed. Organizations should monitor the RichFilemanager GitHub repository for security updates and patch releases. In the absence of an official fix, implementing the workarounds below is strongly recommended.

Workarounds

• Configure .htaccess or equivalent web server rules to prevent script execution in upload directories
• Implement a whitelist-based approach allowing only specific, safe file extensions to be uploaded
• Deploy a web application firewall (WAF) with rules to block malicious file upload attempts
• Consider replacing RichFilemanager with a more actively maintained file management solution
• Restrict network access to the file manager interface using IP whitelisting or VPN requirements

# Apache configuration to prevent script execution in upload directory
# Add to .htaccess in the uploads directory or httpd.conf

<Directory "/path/to/richfilemanager/userfiles">
    # Disable script execution
    php_flag engine off
    
    # Alternative: use handler to serve files as plain text
    AddHandler default-handler .php .phtml .phar
    
    # Deny access to potentially dangerous files
    <FilesMatch "\.(php|phtml|php3|php4|php5|phar|pl|py|cgi|asp|aspx|jsp)$">
        Require all denied
    </FilesMatch>
</Directory>