CVE-2025-5243: Arbitrary File Upload in SMG Software's Information Portal

Severity: critical (CVSS 10.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-07-24 · updated 2026-06-17
Weakness: CWE-78

Description

Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SMG Software Information Portal allows Code Injection, Upload a Web Shell to a Web Server, Code Inclusion. This issue affects Information Portal: before 13.06.2025.

Affected products

SMG Software Information Portal: before 13.06.2025 — fixed in 13.06.2025

How to fix

Upgrade to a fixed version: SMG Software Information Portal 13.06.2025. Check the vendor advisory for mitigations.

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0174
https://www.usom.gov.tr/bildirim/tr-25-0174

Get alerted when CVE-2025-5243 or the next vulnerability affects your stack