Arbitrary file upload in Symfonia Ready
CVE-2025-1980
The Ready_ application's Profile section allows users to upload files of any type and extension without restriction. If the server is misconfigured, as it was by default when installed at the turn of 2021 and 2022, it can result in Remote Code Execution. Refer to the Required Configuration for Exposure section for more information.
Vulnerability class: Unrestricted File Upload
EPSS: 0.010 (58.7th percentile) — read the EPSS interpretation.
Affected products
- Symfonia Ready_ — versions 7.0.0.0, 8.0.0.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cvd@cert.pl (third-party-advisory)
- cvd@cert.pl (third-party-advisory)
- cvd@cert.pl (product)
Frequently asked questions
- What is CVE-2025-1980?
- CVE-2025-1980 is a vulnerability in Symfonia Ready, classified under Unrestricted Upload of File with Dangerous Type. Published 2025-04-16.
- Is CVE-2025-1980 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.