Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-34046: Fanwei E-Office Unsecured File Upload Allows Remote Code Execution

CVE-2025-34046 · published 1 year ago

Summary

An attacker can upload malicious files to the Fanwei E-Office management interface without needing a password, potentially allowing them to take control of the server. This is a serious security risk because it could lead to the entire web application and possibly the underlying system being compromised. To fix this, update the software to a version newer than 9.4.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
shanghai fanwei network technology	e-office	<= 9.4

Original advisory text

Fanwei E-Office Unauthenticated File Upload

An unauthenticated file upload vulnerability exists in the Fanwei E-Office <= v9.4 web management interface. The vulnerability affects the /general/index/UploadFile.php endpoint, which improperly validates uploaded files when invoked with certain parameters (uploadType=eoffice_logo or uploadType=theme). An attacker can exploit this flaw by sending a crafted HTTP POST request to upload arbitrary files without requiring authentication. Successful exploitation could enable remote code execution on the affected server, leading to complete compromise of the web application and potentially the underlying system. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.

References

https://vulncheck.com/advisories/fanwei-eoffice-file-upload Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/34xxx/CVE-2025-34046... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-34046 Vendor Advisory
https://www.cnvd.org.cn/flaw/show/CNVD-2021-49104 Vendor Advisory
https://github.com/M0ge/CNVD-2021-49104-Fanwei-Eoffice-fileupload/blob/main/eoff... Exploit
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cnvd/2021/CN... Exploit

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

9.9 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-434Unrestricted File Upload

Timeline

Published26 Jun 2025

Updated3 Nov 2026

First seen7 Mar 2026

Sources

CVE-2025-34046 · NVD

CVE-2025-34046 · MITRE

CVE-2025-34046 · OSV

Track software like this

Free during beta