CVE Intelligence
Analysis AI-assisted

CVE-2025-61506: MediaCrush Unrestricted File Upload Vulnerability

CVE-2025-61506 affects MediaCrush through version 1.0.1 and allows remote, unauthenticated users to upload arbitrary files of any size via the /upload endpoint. The record maps it to CWE-434 and assigns a CVSS 3.1 base score of 9.8 (Critical). The record shows no KEV listing, no EPSS value and no fixed version.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2025-61506 is an unrestricted file upload weakness (CWE-434) in MediaCrush through version 1.0.1. According to the record, the /upload endpoint accepts arbitrary files without authentication and without a size limit.

Impact

  • Remote unauthenticated users may be able to place arbitrary files on the affected service.
  • The CVSS 3.1 vector in the record reports high impact to confidentiality, integrity and availability.
  • The actual consequences depend on how uploaded files are stored and served, which the record does not describe.

Affected products and versions

  • Product: MediaCrush (listed in the record as Mediacrush Mediacrush).
  • Versions: up to and including 1.0.1, according to the record.
  • No fixed version is listed in the record.

Exploitation status

The record shows that the CVE is not listed in the CISA KEV catalog and has no EPSS score. A third-party reference tagged as exploit-related is included in the record, but its contents were not reproduced here. No confirmed exploitation in the wild appears in the sources consulted.

Remediation and mitigation

  • Identify all MediaCrush deployments at version 1.0.1 or earlier and treat them as high priority given the critical score.
  • Restrict access to the upload endpoint, for example behind authentication or network controls, until the maintainer confirms an updated version.
  • Enforce file type, size and storage location restrictions at the application and web server layers.
  • Monitor the project and its maintainer channels for a fixed release, since none is listed in the sources.

Detection guidance

  • Review web server and application logs for unexpected requests to the upload endpoint, especially from unknown sources.
  • Watch upload storage directories for unusual files, particularly executable or script types.
  • Alert on unusually large or frequent uploads to the service.

Limitations of the available information

The record does not provide a fixed version, a vendor advisory, patch details, technical details of the flaw beyond its description, or an EPSS value. The CNA is listed as cve@mitre.org. Whether the software is still maintained is unknown.

Frequently asked questions

What versions of MediaCrush are affected by CVE-2025-61506?

According to the record, versions up to and including 1.0.1 are affected. The record does not list a fixed version.

Is CVE-2025-61506 known to be exploited in the wild?

The record shows the CVE is not listed in CISA KEV. No confirmed exploitation appears in the sources consulted, although a third-party reference tagged as exploit-related is included.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.