CVE-2025-14522 is a medium severity unrestricted file upload (CVSS 6.3) in baowzh hfly up to the stated commit. The CVE record says the exploit is public. No fixed version is confirmed, so the safe course is to take it off the internet, restrict access and fix the input handling.
What's affected
The record lists baowzh hfly, all builds up to commit 638ff9abe9078bc977c132b37acbe1900b63491c.
The weak spot is the file /Public/Kindeditor/php/upload_json.php, through the argument imgFile. The record calls the function unknown, which means the advisory does not give a precise code line. That is typical for reports on this kind of small PHP project.
The record says the product uses a rolling release model, so there are no version numbers for affected or updated releases. It also says the vendor was contacted early and did not respond. Treat it as unpatched unless you can see a commit that changes the handling of this input.
How to check if you're exposed
This is application source you deploy yourself, so there is no package manager entry to query. Work from the files.
First confirm you run the product and version in the record. Look in the project folder for a readme, a version note or the download page you used. Then search the code for the affected file and the argument.
grep -rn "upload_json.php" /var/www/
Swap the path for your web root. If the file exists and handles the imgFile value as the record describes, you match the description. Next, check your web server logs for requests to that file that you do not recognize.
grep "upload_json.php" /var/log/nginx/access.log | tail -n 50
Use your own log path. Also list the upload folder for files that are not images, such as scripts, and for names you do not recognize. You can also run the free in-browser dependency scan on any package manifests that ship with the project.
What to do now
- Find every copy of hfly you or your team run, including test and demo servers.
- Take the application off the public internet, or put it behind a VPN or an IP allowlist, until you can fix it.
- Change the upload handler so it checks file type by content, stores files outside the web root and never lets an uploaded file run as a script.
- Check logs and the database for signs of use, and rotate any passwords stored by the application.
- Pin your deployment to a commit you have reviewed, watch the project repository and the linked reports for a patch, and re-scan once you change the code.
Why it matters
An upload handler decides what kind of file it accepts, where it stores it and whether it can be run. The product is a PHP content site that bundles the KindEditor upload script. Here the record says the handling of imgFile lets someone upload a file that should be refused. The weakness is CWE-284 (improper access control), CWE-434 (unrestricted file upload).
The usual danger is that an uploaded script ends up in a folder the web server executes, which turns a file upload into code running on the server. The advisory does not describe that step for this product, so treat it as the general risk of the class and not a confirmed result here.
The CVE is not on the CISA Known Exploited Vulnerabilities list. The record says a public exploit exists, so patch and contain without waiting for confirmation of attacks.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is checking the file extension enough?
No. Check the file type by content, store uploads outside the web root, rename them on save and make sure the upload folder cannot execute scripts.
Does this CVE appear in the CISA KEV list?
No. The record marks it as not in the Known Exploited Vulnerabilities catalog. It does say a public exploit exists, so treat it as a real risk anyway.
Sources
- Safeguard Gold entry for CVE-2025-14522
- github.com reference
- vuldb.com reference
- vuldb.com reference
- vuldb.com reference
This post is based on the CVE record (published 2025-12-11, source cna@vuldb.com). The reference pages above are the ones the record lists. Check them for any later changes.
Last reviewed: 19 October 2026.
