What’s Vulnerable › Vulnerabilities

CVE-2025-6266: Teledyne FLIR AX8 upload.php unrestricted upload

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-06-19 · updated 2026-06-17
• Weakness: CWE-284

Description

A vulnerability was detected in Teledyne FLIR AX8 up to 1.46. Affected by this vulnerability is an unknown functionality of the file /upload.php. Performing manipulation of the argument File results in unrestricted upload. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 1.49.16 addresses this issue. Upgrading the affected component is recommended. The vendor points out: "FLIR AX8 internal web site has been refactored to be able to handle the reported vulnerabilities."

Affected products

• Teledyne FLIR AX8: before 1.49.16 — fixed in 1.49.16

How to fix

Upgrade to a fixed version: Teledyne FLIR AX8 1.49.16. Check the vendor advisory for mitigations.

References

• https://github.com/YZS17/CVE/blob/main/FLIR-AX8/Unauthority_file_upload_vulnerabililty.md
• https://vuldb.com/?ctiid.313270
• https://vuldb.com/?id.313270
• https://vuldb.com/?submit.586692

Get alerted when CVE-2025-6266 or the next vulnerability affects your stack