What is CVE-2025-3518?

CVE-2025-3518 is a medium-severity vulnerability in Unblu Spark, classified under Improper Access Control. CVSS score: 4.3/10. Published 2025-04-22.

How severe is CVE-2025-3518?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Vulnerability in Unblu Spark

CVE-2025-3518

It technically possible for a user to upload a file to a conversation despite the file upload functionality being disabled. The file upload functionality can be enabled or disabled for specific use cases through configuration. In case the functionality is disabled for at least one use case, the system nevertheless allows files to be uploaded through direct API requests. During the upload file, interception and allowed file type rules are still applied correctly. If file sharing is generally enabled, this issue is not of concern.

EPSS: 0.002 (14.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.

Affected products

Unblu Spark
Unblu Inc. Spark — versions 7.54.1, 8.13.1, 7.0.0

Weakness classification (CWE)

CWE-284 — Improper Access Control

References

vulnerability@ncsc.ch (Vendor Advisory)

Frequently asked questions

What is CVE-2025-3518?: CVE-2025-3518 is a medium-severity vulnerability in Unblu Spark, classified under Improper Access Control. CVSS score: 4.3/10. Published 2025-04-22.
How severe is CVE-2025-3518?: Medium severity. CVSS v3 base score is 4.3 out of 10.