CVE-2025-4430: Unauthorized file manipulation in EZD RP

Severity: high (CVSS 8.6 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-05-14 · updated 2026-06-17
Weakness: CWE-862

Description

Unauthorized access to "/api/Token/gettoken" endpoint in EZD RP allows file manipulation.This issue affects EZD RP in versions before 20.19 (published on 22nd August 2024).

Affected products

Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy EZD RP: before 20.19 — fixed in 20.19

How to fix

Upgrade to a fixed version: Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy EZD RP 20.19. Check the vendor advisory for mitigations.

References

https://cert.pl/en/posts/2025/05/CVE-2025-4430/
https://www.gov.pl/web/ezd-rp

Get alerted when CVE-2025-4430 or the next vulnerability affects your stack