MITRE Corporation

Accessing Functionality Not Properly Constrained by ACLs

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Generate a new, unique filename for an uploaded file instead of using the user-supplied filename, so that no external input is used at all.

When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.

Consider storing the uploaded files outside of the web document root entirely. Then, use other mechanisms to deliver the files dynamically.

Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

Unrestricted Upload of File with Dangerous Type

Secure Design Principles

Insecure Design

Block execution/output of uploaded files

Server Side Request Forgery Prevention Cheat Sheet

Web Service Security Cheat Sheet

Reject non-whitelisted content types

Third Party Javascript Management Cheat Sheet

File Upload Cheat Sheet

Validate file type of data from untrusted sources

MITRE CWE

MITRE CAPEC

OWASP Top 10

OWASP OpenCRE

Metasploit Framework

ProjectDiscovery nuclei-templates

Exploit-DB

CVE Program CNA list

RichFilemanager

CVE-2025-63994 is identified as a vulnerability involving CWE-434 (Unrestricted Upload of File with Dangerous Type) affecting version 2.7.6 of the software. The lack of detailed description and absence of CVSS score limits the technical details available. No patch or remediation information is currently provided, and no active exploitation is known.

CVE Database V5

Detailed information about CVE-2025-63994: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2025-63994 has been rejected

Official rejection reason