Arbitrary file upload in Siemens Tia Project-Server
CVE-2025-27127
A vulnerability has been identified in TIA Project-Server (All versions < V2.1.1), TIA Project-Server V17 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions), Totally Integrated Automation Portal (TIA Portal) V18 (All versions), Totally Integrated Automation Portal (TIA Portal) V19 (All versions < V19 Update 4), Totally Integrated Automation Portal (TIA Portal) V20 (All versions < V20 Update 3). The affected application improperly handles uploaded projects in the document root. This could allow an attacker with contributor privileges to cause denial of service by uploading a malicious project.
Vulnerability class: Unrestricted File Upload
EPSS: 0.003 (19.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L.
Affected products
- Siemens Tia Project-server — versions 0
- Siemens Tia Project-server V17 — versions 0
- Siemens Totally Integrated Automation Portal (Tia Portal) V17 — versions 0
- Siemens Totally Integrated Automation Portal (Tia Portal) V18 — versions 0
- Siemens Totally Integrated Automation Portal (Tia Portal) V19 — versions 0
- Siemens Totally Integrated Automation Portal (Tia Portal) V20 — versions 0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-27127?
- CVE-2025-27127 is a medium-severity vulnerability in Siemens Tia Project-Server, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 4.3/10. Published 2025-07-08.
- How severe is CVE-2025-27127?
- Medium severity. CVSS v3 base score is 4.3 out of 10.