CVE-2025-14532 is a critical (9.8) unrestricted file upload in DobryCMS from Studio Fabryka. An unauthenticated attacker can upload files of any type, which can lead to remote code execution. The fix is in versions above 5.0, but 5.0 is also listed as affected, so confirm the exact build with the vendor.
What's affected
CERT Polska lists DobryCMS versions 1.0 through 1.x, 2.0 through 2.x and 5.0 as affected. It says the issue was fixed in versions above 5.0. Since 5.0 is also listed as affected, the first fixed release is not clear from the page, so ask Studio Fabryka for the exact build.
The issue was reported to CERT Polska by Dawid Radzinski of RED SECURITY, and the advisory was published on 2 March 2026. It lists no workaround.
The CVSS vector is AV:N/AC:L/PR:N/UI:N, high on all impact measures, so no login is needed.
How to check if you're exposed
Check your site.
- Ask your web agency or the vendor which DobryCMS version your site runs.
- Look in the upload directories for files with extensions that are not images or documents, such as script files.
- Review web server logs for upload requests from unknown addresses and for requests to unusual files in the upload path.
- Confirm that the web server does not run scripts from the upload directory.
What to do now
- Confirm the version with Studio Fabryka and get a build above 5.0 that is stated to contain the fix.
- Apply the update on a staging copy first, then on production.
- Block script execution in upload directories at the web server.
- Remove any unexpected files from uploads and treat the server as possibly compromised if you find script files you did not add.
- Rotate database and application credentials if you find evidence of misuse.
Why it matters
The weakness is CWE-434, unrestricted upload of a file with a dangerous type. The server accepts whatever file is sent, with any extension, and stores it where the web server may run it. That makes the upload feature a way to place code on the server.
The usual defenses are to require authentication, allow only a short list of file types and check the content, store files outside the web root, and disable script execution in the upload folder. Any one of them reduces the damage and together they remove it.
Quick check
Does the attacker need to log in?
No. The advisory describes an unauthenticated remote attacker.
Sources
Last reviewed: 19 October 2026.
