CVE-2025-3969 is a medium severity unrestricted file upload flaw (CVSS 6.3) in code-projects News Publishing Site Dashboard 1.0. The category image field on the edit category page accepts files it should refuse. No fix is named, so restrict access and add upload checks.
What's affected
The record names News Publishing Site Dashboard 1.0 from code-projects. The affected file is /edit-category.php, and the field involved is category_image on the Edit Category page.
The CVSS vector shows network access, low complexity, and a low privilege account required. That usually means a logged in editor or admin. The record says the exploit has been disclosed to the public and may be used. It names no fixed release, and the reference list holds a third party write-up and a VulDB entry rather than a vendor advisory.
How to check if you're exposed
- Find the deployment on your servers and confirm the version is 1.0.
- Look at where uploaded category images are stored. If that folder sits inside the web root and the server runs scripts from it, the risk is higher.
- List what is in the upload folder. Anything that is not an image deserves a look.
- Check logs for requests to the edit category page from unfamiliar addresses.
find /var/www/html -path "*upload*" -type f ! -name "*.jpg" ! -name "*.jpeg" ! -name "*.png" ! -name "*.gif" ! -name "*.webp"
Adjust the path for your install. The command lists files in upload folders that are not common image types.
What to do now
- Restrict the dashboard to trusted networks or put it behind a VPN or single sign on.
- In the code, allow only a short list of image types, check the real content of the file and not only its name, and store files under generated names.
- Store uploads outside the web root, or turn off script execution in the upload folder at the web server level.
- Remove any file in the upload folder that should not be there, and review the accounts that can reach the dashboard.
- Check the vendor site for a newer release before you rely on any fix, and plan a replacement if none appears.
Why it matters
The record maps this to CWE-284 (improper access control) and CWE-434 (unrestricted upload of a file with a dangerous type). When an upload field trusts the file it is given, an attacker can place content on your server that the server may later serve or run.
The score is medium because a low privilege account is needed and the record rates impact as low in each area. Real impact depends on your server settings. A site that runs scripts from its upload folder is in a much worse position than one that serves only static files.
This CVE is not on the CISA Known Exploited Vulnerabilities list.
Quick check
Is checking the file extension enough?
No. Names are easy to fake. Check the real file type, limit the allowed list, rename the file and keep it where scripts cannot run.
Sources
The CVE record also lists third party write-ups and a VulDB entry. They are not vendor advisories, and this post does not reproduce any exploit detail from them.
Last reviewed: 18 October 2026.
