CVE-2025-0471 is a critical (9.9) unrestricted file upload flaw in the PMB library platform, versions 4.0.10 and above. INCIBE reported no solution at the time of its notice. Restrict access to PMB, review uploads, and check the vendor for a fixed release.
What's affected
The record says the flaw affects PMB, a library management platform from SIGB, in versions 4.0.10 and above. INCIBE, Spain's national cybersecurity institute, coordinated the disclosure in notice INCIBE-2025-0012, posted on 14 January 2025. The notice lists the affected resources as versions 4.2.13 and below and versions 4.0.10 and above.
The notice covers three vulnerabilities in total, one critical, one high and one medium. This post is about the critical one. The two siblings are CVE-2025-0472, an information exposure flaw in versions 4.2.13 and earlier, and CVE-2025-0473, which lets a temporary file persist on the server through the file upload at the authorities import endpoint.
The weakness is CWE-434, unrestricted upload of a file with a dangerous type. The record says an attacker could upload a file to gain remote access to the machine, and then access, modify and execute commands freely.
The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. It needs a low privilege account and no user interaction, and the scope is marked as changed, which means a compromise can reach beyond the PMB application itself. All three impact areas are rated high, hence the 9.9. The record does not mark the flaw as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.
INCIBE's notice says there is no reported solution at this time. That was true when the notice was posted. A fix may exist now, so check the vendor and project pages instead of relying on this post.
How to check if you're exposed
Find your PMB version in the administration screens or in the application's version file, and compare it with the affected ranges in the notice. If you run 4.0.10 or later, treat the install as affected unless the vendor says otherwise.
Next, look for signs that someone has used the upload path. Review the web server's access logs for POST requests to upload and import endpoints from accounts or addresses you do not recognise. On the server, look for script files in directories the application writes to:
find /var/www -type f \( -name "*.php" -o -name "*.phtml" \) -mtime -60
Compare the results against your known installed files or a clean copy of the release. Unexpected scripts in upload or temporary folders need investigation.
Finally, list who holds accounts. The vector needs a low privilege login, so every staff or patron account that can reach an upload feature widens the exposure.
What to do now
- Identify every PMB instance, including test copies, and record the version of each.
- Put the application behind a VPN or an allow list if it does not need to be public, and consider taking the upload and import features out of use.
- Check the vendor and project release notes and the INCIBE notice for a fixed version, then apply it after a backup and test.
- Configure the web server so uploaded files cannot be run as scripts, and move upload storage outside the web root where the platform allows.
- Review accounts and remove any that are unused. Rotate credentials for administrators.
- If you find an unexpected script file, treat the host as compromised: isolate it, preserve logs, and rebuild from a clean source.
Why it matters
Unrestricted upload is one of the most direct routes from a web form to code execution. When an application stores a file the user chose and the server will run it, uploading becomes the same as running code. Safe handling means an allow list of file types, content checks, random file names, and storage that never executes.
The rating of 9.9 reflects two things: how little an attacker needs and how much they gain. Library and school systems often hold personal data about patrons, and they run on servers shared with other services, which is why a changed scope matters.
Quick check
Is there a fix for CVE-2025-0471?
INCIBE reported no solution when it posted the notice. Check the vendor and project pages for a release newer than that notice before you decide.
Why is the score 9.9 if a login is needed?
The login needed is only a low privilege one, nothing else is required, and the scope changes. The impact on confidentiality, integrity and availability is rated high.
Sources
Last reviewed: 19 October 2026.
