CVE-2025-13544 is a medium severity unrestricted file upload in ashraf-kabir travel-agency no versioning, up to commit 1f25aa03544bc5fb7a9e846f8a7879cecdb0cad3, scored 6.3 by CVSS 3.1. The upload handling in /customer_register.php accepts files it should reject. The record lists no fix, so add file checks and review what has already been uploaded.
What's affected
The record names ashraf-kabir travel-agency, no versioning, up to commit 1f25aa03544bc5fb7a9e846f8a7879cecdb0cad3. The affected code is /customer_register.php, and the input at fault is the registration upload. The attack is remote and low complexity with no user interaction. The vector shows a low privilege account is required.
The record says an exploit has been disclosed publicly. It does not say the flaw is exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list. The record says the vendor was contacted early about the disclosure and did not respond. The record also says the product has no release versions, so affected and fixed releases are not listed.
No fixed version is named in the record or its references.
How to check if you're exposed
Find out where the app is deployed and which folder receives uploads. Then list what is in that folder. Anything that is not an image or document you expect, in particular files with script extensions such as .php, is a red flag.
find /path/to/uploads -type f ! -iname "*.jpg" ! -iname "*.png" ! -iname "*.gif"
Review the web server configuration as well. If the upload folder is served by a web server that also runs PHP, an uploaded script may be executable. Check access logs for requests to the upload path from unknown clients. A static analysis scan of the upload handler will show whether file type and content are checked at all.
What to do now
- Find every copy of this application, including test copies.
- Restrict access to the upload feature until it is fixed. If it is not needed, disable it.
- Review the upload folder and remove unknown files after keeping copies for investigation.
- Configure the web server so that the upload folder never executes scripts.
- In the code, accept only an allowlist of file types, check content rather than just the file name, and store files with generated names outside the web root where you can.
- Check the maintainer's site for a newer release before relying on any claim of a fix.
- If you find a script in the upload folder, treat the host as compromised and rotate credentials stored on it.
Why it matters
The weaknesses named are CWE-434 (unrestricted upload of a file with a dangerous type) and CWE-284 (improper access control). The application lets a user choose what goes onto the server and does not enough to confirm it is harmless. The danger is greatest when the stored file can then be fetched and run by the web server, which turns a file upload into code execution.
The scores are modest because the vector rates each of confidentiality, integrity and availability impact as low, and the record does not claim the upload becomes code execution. Real impact depends on server configuration, which is why checking the upload folder matters more than the number.
Upload handlers are a common weak spot in small PHP projects. The Gold directory tracks this entry.
Quick check
Is there a patch for CVE-2025-13544?
The record does not name one. Check the maintainer's site and the advisory, and add upload validation yourself if you must keep the app running.
How do I tell if I was hit?
Look in the upload folder for files that are not the images or documents you expect, especially script files, and review access logs for requests to them.
Sources
Last reviewed: 19 October 2026.
