High severity · published Aug 19, 2025
CVE-2025-8450
Unrestricted File Upload in FileCatalyst
8.2
CVSS
0.3%
EPSS
No
On KEV
Description
Improper Access Control issue in the Workflow component of Fortra's FileCatalyst allows unauthenticated users to upload arbitrary files via the order forms page.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FI
FileCatalyst · Fortra
5.1.6 through 5.2.0 Build 80 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-8450
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-8450
www.fortra.com
https://www.fortra.com/security/advisories/product-security/fi-2025-010
More from FileCatalyst
9.8
CVE-2024-25153
Remote Code Execution in FileCatalyst Workflow 5.x prior to 5.1.6 Build 114
9.1
CVE-2024-5276
SQL Injection Vulnerability in FileCatalyst Workflow 5.1.6 Build 135 (and earlier)
6.1
CVE-2024-25155
Reflected Cross-Site Scripting (XSS) in FileCatalyst Direct 3.8.8 and earlier
5.3
CVE-2024-25154
Path Traversal in FileCatalyst Direct 3.8.8 and Earlier