CVE-2025-29866

Severity: high (CVSS 8.8 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-08-07 · updated 2026-06-17
Weakness: CWE-73

Description

: External Control of File Name or Path vulnerability in TAGFREE X-Free Uploader XFU allows : Parameter Injection.This issue affects X-Free Uploader: from 1.0.1.0084 before 1.0.1.0085, from 2.0.1.0034 before 2.0.1.0035.

Affected products

TAGFREE X-Free Uploader: from 1.0.1.0084 before 1.0.1.0085; from 2.0.1.0034 before 2.0.1.0035 — fixed in 1.0.1.0085, 2.0.1.0035

How to fix

Upgrade to a fixed version: TAGFREE X-Free Uploader 1.0.1.0085, 2.0.1.0035. Check the vendor advisory for mitigations.

References

https://www.boho.or.kr/kr/bbs/view.do?searchCnd=&bbsId=B0000302&searchWrd=&menuNo=205023&pageIndex=1&categoryCode=&nttId=71827

Get alerted when CVE-2025-29866 or the next vulnerability affects your stack