CVE-2025-12862 is a medium severity unrestricted file upload flaw (CVSS 6.3) in projectworlds Online Notes Sharing Platform 1.0. It affects /dashboard/userprofile.php through the image argument. The record lists no fixed version, so validate uploads in your own copy and restrict access.
What's affected
The record names projectworlds Online Notes Sharing Platform 1.0. The vulnerable file is /dashboard/userprofile.php, and the argument is image, the profile picture upload. The description says that manipulating the argument leads to unrestricted upload and that the attack can be performed remotely.
The vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. It is network reachable, low complexity, and it needs a low privilege account, such as a normal registered user. Impact is rated low on each of confidentiality, integrity and availability. The description says the exploit is publicly available.
There is no fixed version in the record. The product appears to be a standalone PHP project distributed as source code, so check the vendor page and the references for any update.
How to check if you're exposed
- Find any deployment of the application:
find /var/www -type f -name "userprofile.php" 2>/dev/null
- Look at the upload handling in that file. Does it check the file type by content, restrict the extension to a short allowlist, and rename the file?
- Look at the upload directory. Files that are not images, or files with script extensions such as php, are a warning sign:
find /var/www -path "*upload*" -type f \( -name "*.php" -o -name "*.phtml" \) 2>/dev/null
- Check whether the web server is configured to run scripts from the upload directory. It should not be.
The free in-browser scan covers dependency manifests, and the Gold page for CVE-2025-12862 tracks the record.
What to do now
- Find and inventory all deployments of the app. Remove demo or unused ones.
- Disable script execution in the upload directory at the web server level.
- Fix the handler. Accept only a short allowlist of image types, check the content rather than the name, generate a new random file name, and store uploads outside the web root where possible.
- Remove any file in the upload directory that is not a genuine image, and keep a copy for review before you delete it.
- Review sign ups and profile changes for accounts you do not recognise. Registration is what gives access to the vulnerable page.
- Restrict public registration if you do not need it.
Why it matters
Unrestricted upload is a weakness where an application accepts a file without checking what it is. The record maps it to CWE-434, unrestricted upload of a file with dangerous type, and CWE-284, improper access control. If the server will run a script that someone uploaded, the upload becomes a way to run code. Whether that is possible depends on server configuration, which is why the upload directory settings matter as much as the application code.
The score is medium because a registered account is needed. Open sign up pages remove that barrier in practice. The record does not flag CVE-2025-12862 as a CISA Known Exploited Vulnerability and does not claim exploitation in the wild.
Quick check
Is there a patched version of Online Notes Sharing Platform?
The record lists none. Check the vendor and the references, and fix the upload handler in your own copy.
Do I need an account to exploit this?
Per the vector, a low privilege account is needed. If sign up is open, that is easy to obtain.
Sources
References listed in the CVE record:
- https://github.com/K1nakoo/cve/blob/main/tmp74/report.md
- https://vuldb.com/?ctiid.331509
- Gold entry for CVE-2025-12862
Last reviewed: 19 October 2026.
