Login Request a demo
Critical severity · published Jan 28, 2026
CVE-2025-57794
Explorance Blue versions prior to 8.14.9 contain an authenticated unrestricted file upload vulnerability in the administrative interface
9.1
CVSS
0.6%
EPSS
No
On KEV
Description
Explorance Blue versions prior to 8.14.9 contain an authenticated unrestricted file upload vulnerability in the administrative interface. The application does not adequately restrict uploaded file types, allowing malicious files to be uploaded and executed by the server. This condition enables remote code execution under default configurations.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BL
Blue · Explorance
before 8.14.9 · source: NVD
Affected product
BL
Blue
Explorance
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-57794
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-57794
Third Party Advisory
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0003.md
Vendor Advisory
https://online-help.explorance.com/blue/articles/security-advisories-(january-2026)
Vendor Advisory
https://online-help.explorance.com/blue/articles/security-advisory:-cve-2025-57794
Product
https://www.explorance.com/products/blue
More from Blue
10.0
CVE-2025-57792
Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of user input in a web application endpoint
9.9
CVE-2025-57795
Explorance Blue versions prior to 8.14.13 contain an authenticated remote file download vulnerability in a web service component
8.6
CVE-2025-57793
Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of user-supplied input in a web application component
6.8
CVE-2025-57796
Explorance Blue versions prior to 8.14.12 use reversible symmetric encryption with a hardcoded static key to protect sensitive data, including user passwords and system…
6.1
CVE-2025-52344
Multiple Cross Site Scripting (XSS) vulnerabilities in input fields in Explorance Blue 8.1.2 allows attackers to inject arbitrary JavaScript code on the user's browser via the…