CVE-2025-40625 is a critical unrestricted file upload flaw in TCMAN GIM, with a CVSS score of 9.8. INCIBE says TCMAN fixed it in version 1280. Treat any instance reachable from untrusted networks as exposed until you have confirmed the fix, and review your logs for unexpected requests.
What's affected
- Product: TCMAN GIM version 11, a tool for managing maintenance services and the physical assets of an organisation.
- Fixed version: INCIBE says TCMAN fixed these vulnerabilities in version 1280.
- Severity: Critical, CVSS 9.8 (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
- Weakness: CWE-434.
- Published: 2025-05-06.
The record says an unauthenticated attacker could upload any file to the server, including a malicious one, and so reach remote code execution. The advisory does not name the upload endpoint.
It is the sixth CVE in INCIBE advisory INCIBE-2025-0218. The other five (CVE-2025-40620 to CVE-2025-40624) are SQL injection flaws in other endpoints of the same product.
How to check if you're exposed
The advisory does not give a command for reading the installed version, and this is a vendor-supplied product, so the useful check is administrative:
- Find the version or build number your organisation runs.
- Compare it with the fixed version in the advisory.
- If you cannot read the build number yourself, ask the vendor to confirm in writing.
You can also run your dependency manifests and container images through the free in-browser scan to see which known CVEs affect the packages you ship. It will not find a flaw inside a vendor appliance or an unmanaged install, so keep an inventory of those too.
What to do now
- Identify every copy of TCMAN GIM you run, including test and forgotten ones.
- Confirm that GIM is at version 1280 or later, and review the upload and web directories on the server for files you did not expect.
- Until that is done, remove public access where you can. Put the application behind a VPN, a network allow list or a web application firewall rule, and watch the access and database logs for unusual requests to the endpoint named above.
- Record the outcome, including the date, the version you ended on and who confirmed it, so a later audit has something to read.
- Add the product to your continuous monitoring so a future CVE against it reaches you without a manual search.
Why it matters
Unrestricted file upload means the server accepts a file without checking its type, name or destination. If the upload lands in a folder the web server executes, an attacker can place code there and run it, which is how an upload flaw turns into remote code execution. The class is catalogued as CWE-434 (unrestricted upload of a dangerous file type).
Defenders usually combine several controls: allow only expected file types, rename files on arrival, store them outside the web root, and never mark the upload folder as executable. Here the record says no login is needed, so the exposure is wider than for a bug behind a sign in.
The record's KEV flag is false, so CISA does not list it as known to be exploited, and nothing in the sources here says it is being exploited in the wild.
Quick check
What does the score of 9.8 mean for TCMAN GIM?
The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reads as network reachable, low complexity, no privileges and no user interaction. The impact ratings are confidentiality high, integrity high, availability high. Use it to rank the work, then confirm exposure for your own deployment.
Why does a file upload bug lead to remote code execution?
The server may run an uploaded script when someone requests it. If the upload folder is served by the web server and scripts are executable there, the file becomes a program the attacker controls.
Sources
Last reviewed: 18 October 2026.
