CVE-2025-29865

Severity: high (CVSS 8.7 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-08-07 · updated 2026-06-17
Weakness: CWE-22

Description

: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TAGFREE X-Free Uploader XFU allows Path Traversal.This issue affects X-Free Uploader: from 1.0.1.0084 before 1.0.1.0085, from 2.0.1.0034 before 2.0.1.0035.

Affected products

TAGFREE X-Free Uploader: from 1.0.1.0084 before 1.0.1.0085; from 2.0.1.0034 before 2.0.1.0035 — fixed in 1.0.1.0085, 2.0.1.0035

How to fix

Upgrade to a fixed version: TAGFREE X-Free Uploader 1.0.1.0085, 2.0.1.0035. Check the vendor advisory for mitigations.

References

https://www.boho.or.kr/kr/bbs/view.do?searchCnd=&bbsId=B0000302&searchWrd=&menuNo=205023&pageIndex=1&categoryCode=&nttId=71825

Get alerted when CVE-2025-29865 or the next vulnerability affects your stack