Arbitrary file upload in Symfonia Ready
CVE-2025-1980
The Ready_ application's Profile section allows users to upload files of any type and extension without restriction. If the server is misconfigured, as it was by default when installed at the turn of 2021 and 2022, it can result in Remote Code Execution. Refer to the Required Configuration for Exposure section for more information.
Vulnerability class: Unrestricted File Upload
Published · last modified .
EPSS exploit prediction
EPSS: 0.011 (63.8th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 64th percentile — 63.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.010 · newest: 0.011 · change: +0.001
Affected products
- Symfonia Ready — versions 7.0.0.0, 8.0.0.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cert.pl/posts/2025/04/CVE-2025-1980 (third-party-advisory)
- cert.pl/en/posts/2025/04/CVE-2025-1980 (third-party-advisory)
- ready-os.com/pl/ (product)
Frequently asked questions
- What is CVE-2025-1980?
- CVE-2025-1980 is a vulnerability in Symfonia Ready, classified under Unrestricted Upload of File with Dangerous Type. Published 2025-04-16.
- Is CVE-2025-1980 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.