CVE-2025-35032: Medical Informatics Engineering Enterprise Health arbitrary file upload

Severity: critical (CVSS 9.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-29 · updated 2026-10-09
Weakness: CWE-434

Description

Medical Informatics Engineering Enterprise Health allows authenticated users to upload arbitrary files. The impact of this behavior depends on how files are accessed. This issue is fixed as of 2025-04-08.

Affected products

Medical Informatics Engineering Enterprise Health: rc202303, rc202309, rc202403, rc202409, rc202503

References

https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-272-01.json
https://www.cve.org/CVERecord?id=CVE-2025-35032

Get alerted when CVE-2025-35032 or the next vulnerability affects your stack