CVE-2025-65844
📋 TL;DR
CVE-2025-65844 is an unauthenticated arbitrary file upload vulnerability in EverShop 2.0.1 that allows attackers to upload any file type and create directories via the /api/images endpoint. This can lead to credential theft through fake login pages and denial-of-service attacks via disk space exhaustion. All EverShop 2.0.1 installations with default configurations are affected.
💻 Affected Systems
- EverShop
📦 What is this software?
Evershop by Evershop
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through credential exfiltration via fake admin panels, followed by ransomware deployment or data destruction.
Likely Case
Credential harvesting through fake login pages and denial-of-service via disk space exhaustion.
If Mitigated
Limited impact with proper authentication and file validation controls in place.
🎯 Exploit Status
Simple HTTP POST requests to /api/images with malicious files can exploit this vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: https://github.com/evershopcommerce/evershop/issues/819
Restart Required: No
Instructions:
No official patch available. Apply workarounds or upgrade when patch is released.
🔧 Temporary Workarounds
Implement Authentication on /api/images
allAdd authentication middleware to the /api/images endpoint to require valid user credentials.
Modify route configuration to require authentication
Implement Strict File Validation
allAdd server-side validation to only accept specific image file types and verify file signatures.
Implement file type checking and MIME validation
Disable /api/images Endpoint
allTemporarily disable the vulnerable endpoint until proper fixes are implemented.
Comment out or remove /api/images route configuration
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block file uploads to /api/images
- Monitor disk usage and file upload patterns for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Attempt to upload a non-image file (e.g., .php, .html) to /api/images endpoint without authentication.Check Version:
Check package.json or application configuration for EverShop versionVerify Fix Applied:
Verify that file uploads to /api/images require authentication and only accept validated image files.📡 Detection & Monitoring
Log Indicators:
- Multiple file upload requests to /api/images
- Uploads of non-image file types
- Rapid disk space consumption
Network Indicators:
- HTTP POST requests to /api/images with suspicious file extensions
- Unusual traffic patterns to upload endpoints
SIEM Query:
source="webserver" AND (uri="/api/images" AND method="POST") AND (file_extension!="jpg" AND file_extension!="png" AND file_extension!="gif")