The application generates uploaded file names using a weak and predictable method based on the request timestamp. (CVE-2025-14602)
The application uses a weak and predictable method to generate uploaded file names based on the request timestamp. This vulnerability allows remote attackers to guess or brute-force file names within a short time window, potentially enabling unauthorized access to uploaded files. The vendor has released a patch starting from version 14.0101 to address this issue.
AI Analysis
Technical Summary
CVE-2025-14602 describes a vulnerability where the application generates uploaded file names using a predictable scheme derived from the request timestamp. This weakness enables attackers to accurately guess or brute-force the generated file names shortly after upload, facilitating unauthorized access to these files. The vulnerability is classified under CWE-340 (Use of a One-Way Hash without a Salt). The vendor has issued a patch beginning with version 14.0101 to remediate this issue.
Potential Impact
An attacker can locate and access uploaded files by predicting their file names, which may lead to unauthorized data exposure or facilitate further attacks. The vulnerability does not require user interaction and can be exploited remotely with low complexity. The overall severity is assessed as medium.
Mitigation Recommendations
A patch is available from the vendor and should be applied. Versions 14.0101 and later include the fix. Users should upgrade to these versions to mitigate the vulnerability.
The application generates uploaded file names using a weak and predictable method based on the request timestamp. (CVE-2025-14602)
Description
The application uses a weak and predictable method to generate uploaded file names based on the request timestamp. This vulnerability allows remote attackers to guess or brute-force file names within a short time window, potentially enabling unauthorized access to uploaded files. The vendor has released a patch starting from version 14.0101 to address this issue.
CVSS v4.0
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-14602 describes a vulnerability where the application generates uploaded file names using a predictable scheme derived from the request timestamp. This weakness enables attackers to accurately guess or brute-force the generated file names shortly after upload, facilitating unauthorized access to these files. The vulnerability is classified under CWE-340 (Use of a One-Way Hash without a Salt). The vendor has issued a patch beginning with version 14.0101 to remediate this issue.
Potential Impact
An attacker can locate and access uploaded files by predicting their file names, which may lead to unauthorized data exposure or facilitate further attacks. The vulnerability does not require user interaction and can be exploited remotely with low complexity. The overall severity is assessed as medium.
Mitigation Recommendations
A patch is available from the vendor and should be applied. Versions 14.0101 and later include the fix. Users should upgrade to these versions to mitigate the vulnerability.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-2vv3-69qg-3hgr
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2025-14602"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 4.0
Threat ID: 6a870a55acd9273b49b58615
Added to database: 08/20/2026, 14:08:21 UTC
Last enriched: 08/20/2026, 14:19:27 UTC
Last updated: 08/20/2026, 22:52:06 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.