CVE-2025-14199: Medium Unrestricted Upload in Verysync

CVE-2025-14199 is a medium severity (CVSS 6.3) unrestricted file upload in Verysync, versions up to 2.21.3. It affects the Web Administration Module and can be reached remotely. The record names no fixed version and says the vendor did not respond, so keep the admin interface off the internet and check for a newer release.

What's affected

• Product: Verysync (微力同步), file synchronization software.
• Affected versions: up to and including 2.21.3.
• Component: Web Administration Module, a REST path under /rest/f/api/resources/ used to write a file with the override flag set to false.
• Fixed version: none is named in the record. The vendor was contacted early and did not respond, according to the description.
• Weaknesses: CWE-284 (improper access control) and CWE-434 (unrestricted upload of a file with a dangerous type). See the Gold page for CVE-2025-14199.
• Severity: Medium, CVSS 6.3, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.
• CISA KEV: not listed.

How to check if you're exposed

Open the Verysync web interface and read the version number on its about or settings page. If it is 2.21.3 or older, it is in the affected range.

Then check reachability. Verysync's web administration is meant for the owner of the sync node. If the port is open to the internet or to a wide internal network, more people can reach the vulnerable module than should. Test from outside your network and from an ordinary user subnet.

On a server, list processes and listening ports to find every Verysync install, including those set up by individual users. Sync tools often spread by word of mouth inside a company, so an inventory by hand is worth doing.

What to do now

1. Find all Verysync nodes and record their versions.
2. Update to the newest release the vendor offers, and read its notes for any mention of this upload issue. The record does not confirm which release fixes it.
3. Bind the web administration to localhost or a management network, and block it at the firewall from everything else.
4. Use strong, unique credentials on the admin interface.
5. Review the folders the node serves for files you do not recognize, particularly newly created text or script files.
6. If a node holds sensitive data and cannot be restricted, move that sync job to a supported tool.

Why it matters

Unrestricted upload means the application accepts a file without enough checks on where it goes, what it contains or who may send it. The impact depends on what the server does with the uploaded file afterwards. Here the record scores integrity and availability impact as low and confidentiality as low, which is why the score is medium and not high.

It still matters. Sync software holds copies of real documents, and an unexpected file written into a synced folder can travel to every other node in the share. That makes small flaws in the admin module worth closing even when the score looks moderate. The record does not mark this CVE as exploited and it is not in CISA KEV.

Quick check

Sources

• NVD record data for CVE-2025-14199 (Safeguard Gold entry)

Last reviewed: 19 October 2026.