Critical severity · published Dec 23, 2025
CVE-2025-14500
IceWarp14 X-File-Operation Command Injection Remote Code Execution Vulnerability
9.8
CVSS
1.6%
EPSS
No
On KEV
Description
IceWarp14 X-File-Operation Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IceWarp. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of the X-File-Operation header. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-27394.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IC
IceWarp · IceWarp
14.2.0.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-14500
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-14500
www.zerodayinitiative.com
https://www.zerodayinitiative.com/advisories/ZDI-25-1072/
More from IceWarp
8.8
CVE-2025-14499
IceWarp gmaps Cross-Site Scripting Authentication Bypass Vulnerability
7.5
CVE-2026-2493
IceWarp collaboration Directory Traversal Information Disclosure Vulnerability
6.1
CVE-2018-25269
ICEWARP 11.0.0.0 Cross-Site Scripting via Email HTML Injection
6.1
CVE-2024-55218
IceWarp Server 10.2.1 is vulnerable to Cross Site Scripting (XSS) via the meta parameter
6.1
CVE-2024-0246
IceWarp Utility Download cross site scripting