CVE-2005-4855

Severity: low (CVSS 3.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2005-12-31 · updated 2026-06-16
Weakness: CWE-264

Description

Unrestricted file upload vulnerability in eZ publish 3.5 before 3.5.5, 3.6 before 3.6.2, 3.7 before 3.7.0rc2, and 3.8 before 20050922 does not restrict Image datatype uploads to image content types, which allows remote authenticated users to upload certain types of files, as demonstrated by .js files, which may enable cross-site scripting (XSS) attacks or other attacks.

Affected products

Ez Publish: from 3.5.0 before 3.5.5; from 3.6.0 before 3.6.2; 3.7.0-rc1, 3.8.0 — fixed in 3.5.5, 3.6.2

How to fix

Upgrade to a fixed version: Ez Publish 3.5.5, 3.6.2. Check the vendor advisory for mitigations.

References

http://ez.no/download/ez_publish/changelogs/ez_publish_3_8/changelog_3_6_x_3_7_x_to_3_8_0
http://issues.ez.no/5984
http://ez.no/download/ez_publish/changelogs/ez_publish_3_8/changelog_3_6_x_3_7_x_to_3_8_0
http://issues.ez.no/5984

Get alerted when CVE-2005-4855 or the next vulnerability affects your stack