CVE-2025-41347 is a critical unrestricted file upload (CVSS 9.8) in WinPlus v24.11.27 from Informática del Este. A POST request to an upload service can place a webshell on the server. I could not confirm a fix, so restrict access and contact the vendor.
What's affected
The CVE record names WinPlus v24.11.27. The weak point is the upload service at /WinplusPortal/ws/sWinplus.svc/json/uploadfile, which accepts dangerous file types.
This is one of three entries for the same release. CVE-2025-41346 covers user impersonation by numerical ID and CVE-2025-41348 covers a SQL injection. An upload flaw that needs no login combines badly with the others.
The notice listed as a reference could not be loaded for me, so I could not confirm a fixed version. Check with Informática del Este.
How to check if you're exposed
Find where WinPlus runs and confirm the build. If it is v24.11.27 or older, assume it is affected.
Then look at the upload folder or the folders the web service writes to. Look for files with script extensions that were not placed by your own staff, and for files with recent timestamps that do not match business activity.
In web logs, look at POST requests to the upload path from addresses you do not recognize. Do this review even after you restrict access, because an earlier upload may already be in place.
What to do now
- Confirm the build in use on every WinPlus server.
- Restrict the portal to trusted networks and block the upload path at the proxy if you do not need it.
- Make the upload directory non executable, so that a stored file cannot be run by the web server.
- Search for unexpected script files and, if you find any, treat the server as compromised and start incident response.
- Ask the vendor for a fixed release and apply it when available.
Why it matters
This is CWE-434, unrestricted upload of a file with a dangerous type. The server accepts a file and stores it where the web server may run it. A webshell is a small script that lets someone issue commands through the web server, so one upload can become full control of the machine.
The CVE is not on the CISA Known Exploited Vulnerabilities list. The standard defenses are to allow only expected file types, to rename files on arrival, to store them outside the web root, and to require a login. A control missing on all of those fronts earns its critical score.
Quick check
What is a webshell?
It is a script placed on a web server that lets a remote person run commands through the site. The record names it as the goal of the upload.
Can I fix this without a vendor patch?
You can reduce risk by blocking the upload path, restricting access and making the upload folder non executable, but a patch is the real fix. Ask the vendor.
Sources
Last reviewed: 18 October 2026.
