CVE-2025-14182 is a medium severity path traversal flaw (CVSS 6.3) in Sobey Media Convergence System 2.0 and 2.1, affecting the watermark upload endpoint /sobey-mchEditor/watermark/upload, through the File argument. No fixed version is listed, so cut exposure and check the vendor for a patch.
What's affected
The affected component is the watermark upload endpoint /sobey-mchEditor/watermark/upload, through the File argument. The record says manipulating the File argument leads to path traversal and the attack can be started remotely. Versions 2.0 and 2.1 are named.
Affected version: 2.0 and 2.1. The record names no fixed version or vendor patch, so check the vendor site before assuming one exists.
The CVSS vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. The attack vector is the network, and the vector lists low privileges required, so an attacker needs some kind of valid account first. The weakness classes are CWE-22.
The CVE record states that the exploit has been disclosed publicly. That is not the same as exploitation in the wild, which the record does not report, and the CISA Known Exploited Vulnerabilities flag is false. Still, public details lower the effort needed to attack an exposed instance.
How to check if you're exposed
Find out whether you run Sobey Media Convergence System 2.0 or 2.1 and whether the editor module is reachable.
find / -type d -name "sobey-mchEditor" 2>/dev/null
Then review web logs for requests to the watermark upload path and look at the file system for files in places where an upload should never land, such as directories outside the intended upload folder.
grep "watermark/upload" /var/log/nginx/access.log | tail -20
Adapt the log path to your setup. Because the vector requires low privileges, also review which accounts can use the editor.
What to do now
- Confirm whether you run version 2.0 or 2.1 and where the editor module is exposed.
- Restrict the editor and its upload endpoint to trusted networks until a fix is available.
- Make sure the application runs as a low-privilege account that cannot write outside its upload directory.
- Look for unexpected files outside the intended upload folder and remove them after preserving evidence.
- Contact the vendor about a patched version, since the record names none.
Why it matters
Path traversal (CWE-22) means the application builds a file system path from user input without confining it to the intended directory. An attacker who controls the file argument can place or reach files elsewhere on the server.
The effect depends on where files can land. Writing into a location the web server executes can lead to code execution, while overwriting configuration can change application behaviour. A canonical fix resolves the final path and checks that it stays inside the allowed directory.
Try it yourself
The demo shows a container image scan listing the vulnerable components inside an image.
Click through it at your own pace, or open it full screen.
Quick check
How do you prevent path traversal in your own code?
Resolve the full path after joining it, and refuse it unless it still sits inside the allowed base directory. Prefer generated file names over user supplied ones.
Is there a fixed release?
The record names no fixed version or vendor patch, so check the vendor site before assuming one exists.
Sources
- Gold vulnerability page for CVE-2025-14182
- CVE record for CVE-2025-14182 as published by its CNA, with a published date of 2025-12-07
- Free in-browser dependency scan: gold.safeguard.sh/scan
Last reviewed: 19 October 2026.
