CVE-2025-52758 - Vulnerability Details - OpenCVE

Unrestricted Upload of File with Dangerous Type vulnerability in Gesundheit Bewegt GmbH Zippy zippy allows Using Malicious Files.This issue affects Zippy: from n/a through <= 1.7.0.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Gesundheit-bewegt	Zippy
Wordpress	Wordpress

No data.

No data.

References

Link	Providers
https://vdp.patchstack.com/database/Wordpress/Plugin/zippy/vulnerability/wordpress-zippy-plugin-1-7-0-arbitrary-file-upload-vulnerability

History

Thu, 23 Oct 2025 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 23 Oct 2025 10:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Gesundheit-bewegt Gesundheit-bewegt zippy Wordpress Wordpress wordpress
Vendors & Products		Gesundheit-bewegt Gesundheit-bewegt zippy Wordpress Wordpress wordpress

Wed, 22 Oct 2025 14:45:00 +0000

Type	Values Removed	Values Added
Description		Unrestricted Upload of File with Dangerous Type vulnerability in Gesundheit Bewegt GmbH Zippy zippy allows Using Malicious Files.This issue affects Zippy: from n/a through <= 1.7.0.
Title		WordPress Zippy plugin <= 1.7.0 - Arbitrary File Upload vulnerability
Weaknesses		CWE-434
References		https://vdp.patchstack.com/database/Wordpress/Plugin/zippy/vulnerability/wordpress-zippy-plugin-1-7-0-arbitrary-file-upload-vulnerability

MITRE

Status: PUBLISHED

Assigner: Patchstack

Published: 2025-10-22T14:32:27.961Z

Updated: 2025-10-23T15:34:48.953Z

Reserved: 2025-06-19T10:03:02.782Z

Link: CVE-2025-52758

Vulnrichment

Updated: 2025-10-23T15:34:43.738Z

NVD

Status : Awaiting Analysis

Published: 2025-10-22T15:15:45.813

Modified: 2025-10-23T16:16:39.610

Link: CVE-2025-52758

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-52758", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2025-06-19T10:03:02.782Z", "datePublished": "2025-10-22T14:32:27.961Z", "dateUpdated": "2025-10-23T15:34:48.953Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "zippy", "product": "Zippy", "vendor": "Gesundheit Bewegt GmbH", "versions": [{"lessThanOrEqual": "<= 1.7.0", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "63n0 (Patchstack Alliance)"}], "datePublic": "2025-10-22T15:52:29.229Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Unrestricted Upload of File with Dangerous Type vulnerability in Gesundheit Bewegt GmbH Zippy zippy allows Using Malicious Files.<p>This issue affects Zippy: from n/a through <= 1.7.0.</p>"}], "value": "Unrestricted Upload of File with Dangerous Type vulnerability in Gesundheit Bewegt GmbH Zippy zippy allows Using Malicious Files.This issue affects Zippy: from n/a through <= 1.7.0."}], "impacts": [{"capecId": "CAPEC-17", "descriptions": [{"lang": "en", "value": "Using Malicious Files"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-434", "description": "Unrestricted Upload of File with Dangerous Type", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2025-10-22T14:32:27.961Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://vdp.patchstack.com/database/Wordpress/Plugin/zippy/vulnerability/wordpress-zippy-plugin-1-7-0-arbitrary-file-upload-vulnerability"}], "title": "WordPress Zippy plugin <= 1.7.0 - Arbitrary File Upload vulnerability"}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-10-23T15:34:21.439497Z", "id": "CVE-2025-52758", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-23T15:34:48.953Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-52758", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2025-06-19T10:03:02.782Z", "datePublished": "2025-10-22T14:32:27.961Z", "dateUpdated": "2025-10-23T15:34:48.953Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "zippy", "product": "Zippy", "vendor": "Gesundheit Bewegt GmbH", "versions": [{"lessThanOrEqual": "<= 1.7.0", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "63n0 (Patchstack Alliance)"}], "datePublic": "2025-10-22T15:52:29.229Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Unrestricted Upload of File with Dangerous Type vulnerability in Gesundheit Bewegt GmbH Zippy zippy allows Using Malicious Files.<p>This issue affects Zippy: from n/a through <= 1.7.0.</p>"}], "value": "Unrestricted Upload of File with Dangerous Type vulnerability in Gesundheit Bewegt GmbH Zippy zippy allows Using Malicious Files.This issue affects Zippy: from n/a through <= 1.7.0."}], "impacts": [{"capecId": "CAPEC-17", "descriptions": [{"lang": "en", "value": "Using Malicious Files"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-434", "description": "Unrestricted Upload of File with Dangerous Type", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2025-10-22T14:32:27.961Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://vdp.patchstack.com/database/Wordpress/Plugin/zippy/vulnerability/wordpress-zippy-plugin-1-7-0-arbitrary-file-upload-vulnerability"}], "title": "WordPress Zippy plugin <= 1.7.0 - Arbitrary File Upload vulnerability"}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-52758", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-23T15:34:21.439497Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-23T15:34:43.738Z"}}]}}