CVE-2025-11508 is a medium severity (CVSS 4.7) unrestricted file upload flaw in code-projects Voting System 1.0, in /admin/voters_add.php through the photo argument. No fixed version is confirmed. Restrict the admin area, validate uploads on the server and check the vendor for updates.
What's affected
- Product: code-projects Voting System
- Affected: version 1.0
- Weak point: the photo argument handled by /admin/voters_add.php
- Fixed version: none confirmed in the sources reviewed
The weaknesses are CWE-434 (unrestricted upload of a file with a dangerous type) and CWE-284 (improper access control). The CVSS vector requires an administrator account and no user interaction, which keeps the score in the medium range. The record says the attack can be launched remotely.
How to check if you're exposed
This is downloadable PHP source code, so check by inventory and review.
grep -n "photo" /path/to/app/admin/voters_add.php
grep -rn "move_uploaded_file" /path/to/app --include="*.php"
Look at what the handler does with the uploaded file. A safe handler checks the real file type, restricts extensions to an allow list, renames the file and stores it outside the web root. An unsafe one keeps the original name and saves it where the web server can run it.
Then inspect the upload folder for files that are not images, such as scripts, and review access logs for requests to files in it.
find /path/to/app -path "*upload*" -type f -not -name "*.jpg" -not -name "*.jpeg" -not -name "*.png"
What to do now
- If this is a demo or training copy, take it down.
- Restrict the admin area to trusted networks, and change administrator passwords because the attack needs an admin session.
- Fix the upload handler. Accept only the image types you need, check the content and not only the extension, generate a new random file name and store files outside the web root.
- Configure the web server so the upload directory cannot execute scripts.
- Clean the upload folder of anything unexpected and review who added it.
- Watch the vendor and the researcher issue for a patched release before you trust one.
Why it matters
Upload handlers sit on a trust boundary. The server accepts a file from a user, and what happens next decides whether it is harmless data or something the server will run. When the type is not enforced, a file meant to be a photo can be something else.
The record says an exploit is public. It is not a CISA Known Exploited Vulnerability and no source we reviewed reports attacks. The administrator requirement is a real brake, so the highest risk sits with weak or shared admin passwords and with admin sessions that leak.
The two classes together tell a story. The upload check is missing and the access control around it is thin, so any one weak admin account becomes a way to place files on the server.
Quick check
Does an admin only requirement make this safe to ignore?
No. Admin credentials are often weak, shared or stolen, and a medium score still describes a path to placing files on the server. Fix the handler and lock down the admin area.
Is there a patched version of Voting System?
No fixed version is confirmed. Check the vendor site and the researcher issue, and fix the upload code yourself if you control the source.
Sources
- Researcher issue
- CVE record and CVSS vector for CVE-2025-11508, published 2025-10-08
Last reviewed: 19 October 2026.
