CVE-2025-70849: n/a
Source CVE Database V5
Not known to be exploited · CVSS 6.1 Medium.
Data as of 25 Oct 2026, 19:02 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 20% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 3 Feb 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
AI-suggested
To mitigate CVE-2025-70849, European organizations should: 1) Immediately review and restrict access to the /store endpoint, ideally limiting it to trusted users or internal networks. 2) Implement strict Content-Security-Policy (CSP) headers that disallow inline scripts and restrict sources of executable content to trusted domains only. 3) Enforce robust server-side validation of uploaded files, including validating Content-Type headers and file extensions, and rejecting any files that do not conform to expected safe types (e.g., images only). 4) Sanitize and encode any user-supplied content before rendering it in the application to prevent script execution. 5) Monitor logs and network traffic for unusual POST requests to the /store endpoint that may indicate exploitation attempts. 6) Consider deploying web application firewalls (WAFs) with rules to detect and block malicious file uploads and XSS payloads. 7) Stay updated with podinfo releases and apply patches promptly once available. 8) Educate developers and administrators about secure file upload practices and the risks of stored XSS. 9) If podinfo is used only for demos or testing, consider isolating or removing it from production environments to reduce attack surface. 10) Conduct regular security assessments and penetration testing focusing on file upload functionalities and CSP enforcement.
Description
Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy (CSP) or adequate Content-Type validation, leading to Stored Cross-Site Scripting (XSS).