CVE-2025-65783 describes an arbitrary file upload vulnerability in the /utils/uploadFile component of Hubert Imoveis e Administracao Ltda Hub version 2.0 1.27.3. Attackers can exploit this vulnerability by uploading a specially crafted PDF file, which enables execution of arbitrary code on the affected system. This vulnerability corresponds to CWE-434 (Unrestricted Upload of File with Dangerous Type). The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no information about available patches or vendor advisories, and no known exploits in the wild have been reported.

Successful exploitation allows remote attackers to execute arbitrary code on the affected system without authentication or user interaction, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the upload functionality and implement strict validation and filtering of uploaded files to prevent malicious content. Monitor for any updates from the vendor regarding patches or mitigations.