Explorance Blue Authenticated Unrestricted File Upload Vulnerability Allowing Remote Code Execution

A vulnerability exists in the administrative interface of Explorance Blue, in versions prior to 8.14.9, allowing authenticated users to upload files without proper restrictions. The application fails to adequately limit the types of files that can be uploaded, enabling the introduction of malicious files that could be executed by the server. Under default configurations, this vulnerability could lead to remote code execution.

Impact

Exploitation of this vulnerability allows authenticated users with administrative privileges to upload malicious files that are executed on the server, resulting in remote code execution.

Remediation

Users should upgrade to Explorance Blue version 8.14.9 or later. For self-hosted customers, instructions for upgrading are available in the Explorance Blue Security Advisory for CVE-2025-57794.