CVE-2025-66802VulnerabilityPublished 12 Jan 2026

CVE-2025-66802: n/a

Source CVE Database V5

Not known to be exploited · CVSS 9.8 Critical.

Data as of 26 Oct 2026, 07:57 UTC

CVSS 3.1 base score

9.8Critical

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.9% chance of exploitation in 30 days – higher than 60% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: High: There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
Integrity: High: There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.
Availability: High: There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 12 Jan 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

1. Immediately disable all file upload functionality in the affected application until a secure patch is available. 2. Implement strict server-side validation to ensure only legitimate image files are accepted, including MIME type checks, file extension validation, and content inspection. 3. Employ file upload sandboxing and store uploaded files outside the web root to prevent direct execution. 4. Use web application firewalls (WAFs) to detect and block malicious payloads targeting file upload endpoints. 5. Monitor server logs for suspicious activity indicative of reverse shell attempts or unauthorized code execution. 6. Conduct thorough security audits of the contact tracing system and related infrastructure to identify and remediate other potential vulnerabilities. 7. Apply principle of least privilege to web server processes to limit the impact of any successful exploitation. 8. Stay updated with vendor advisories and apply official patches immediately upon release. 9. Educate IT and security teams about the risks associated with file upload vulnerabilities and proper handling procedures. 10. Consider alternative contact tracing solutions with stronger security postures if remediation is delayed.

Description

CVE-2025-66802 is a critical Remote Code Execution (RCE) vulnerability affecting Sourcecodester Covid-19 Contact Tracing System 1.0. The flaw arises from improper handling of user-uploaded images, allowing attackers to upload a PHP reverse shell disguised as an image file. This enables unauthenticated attackers to execute arbitrary code remotely with full system privileges, compromising confidentiality, integrity, and availability. The vulnerability has a CVSS score of 9.8, indicating critical severity, and does not require user interaction or authentication. Although no known exploits are currently in the wild, the high impact and ease of exploitation make this a significant threat. European organizations using this contact tracing system are at risk of full system compromise, data breaches, and disruption of critical public health infrastructure. Immediate mitigation steps include disabling file uploads, implementing strict file validation, and applying patches once available. Countries with widespread use of Sourcecodester applications or strategic interest in Covid-19 tracing systems are most likely to be affected.

Impact

For European organizations, this vulnerability poses a severe risk to public health infrastructure and sensitive personal data related to Covid-19 tracing. Exploitation could lead to unauthorized access to health records, manipulation or deletion of contact tracing data, and disruption of tracing services critical for pandemic management. The compromise of such systems could erode public trust and violate stringent European data protection regulations such as GDPR, potentially resulting in heavy fines and reputational damage. Additionally, attackers could use the compromised servers as footholds for lateral movement within networks, escalating the threat to broader organizational IT environments. The critical nature of the vulnerability and the lack of authentication requirements make it highly exploitable, increasing the urgency for European entities to respond swiftly. The impact extends beyond individual organizations to national health agencies and governments relying on these systems for pandemic response.

Summary

CVE-2025-66802 is a critical vulnerability in Sourcecodester Covid-19 Contact Tracing System 1.0, classified under CWE-434 (Unrestricted Upload of File with Dangerous Type). The vulnerability allows unauthenticated remote attackers to upload malicious PHP files disguised as images. The system fails to properly validate or sanitize uploaded image files, enabling attackers to upload a reverse shell payload. Once uploaded, the attacker can execute arbitrary PHP code remotely, gaining full control over the affected server. This RCE flaw impacts confidentiality, integrity, and availability by allowing data theft, system manipulation, and service disruption. The CVSS v3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and full impact on all security properties. No patches or mitigations are currently published, and no exploits have been observed in the wild yet. The vulnerability is particularly dangerous in the context of a Covid-19 contact tracing system, as it may expose sensitive health data and disrupt critical public health operations. The root cause is inadequate file upload validation, a common web application security issue. Organizations using this software must urgently assess exposure and implement compensating controls.

CWE-434Unrestricted Upload of File with Dangerous Type (opens in a new tab)
Base weaknessLikelihood of exploit: MediumCWE Top 25 (2025): #12OWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Architecture and Design
Generate a new, unique filename for an uploaded file instead of using the user-supplied filename, so that no external input is used at all.
Architecture and Design · Enforcement by Conversion
When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.
Architecture and Design
Consider storing the uploaded files outside of the web document root entirely. Then, use other mechanisms to deliver the files dynamically.
OWASP Cheat Sheets
Server Side Request Forgery Prevention (opens in a new tab)
Web Service Security (opens in a new tab)
Third Party Javascript Management (opens in a new tab)
File Upload (opens in a new tab)
Secure Design Principles (opens in a new tab)
OWASP ASVS 4.0.3
V12.5.2 (opens in a new tab)
V13.1.5 (opens in a new tab)
V12.2.1 (opens in a new tab)
Attack patterns
Accessing Functionality Not Properly Constrained by ACLs (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Description

AI analysisMachine-generated, updated 19 Jan 2026, 19:40 UTC

WeaknessesCWE-434

Technical details

References

Community reviews

Related threats