CVE-2025-34100 is a critical unrestricted file upload vulnerability in BuilderEngine CMS 3.5.0. The issue arises from the integration of elFinder 2.0 and the jQuery File Upload plugin, which fails to properly validate or restrict file types or upload locations. This allows unauthenticated attackers to upload malicious .php files and execute arbitrary PHP code on the server under the web server process context. The root cause is the jQuery File Upload component's lack of validation combined with BuilderEngine's improper integration and missing access controls, leading to full remote code execution.

Successful exploitation enables unauthenticated remote attackers to upload and execute arbitrary PHP code on the affected server, resulting in full remote code execution with the privileges of the web server process. This can lead to complete compromise of the affected system, data theft, service disruption, or further network pivoting. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the file upload functionality, disable or remove the vulnerable file manager integration if possible, and implement network-level protections to limit exposure. Monitor for updates from BuilderEngine regarding patches or official mitigations.