CVE-2025-48782 is a critical flaw (CVSS 9.8) in the upload file function of Soar Cloud HRD Human Resource Management System, through version 7.3.2025.0408. A malicious file lets a remote attacker run system commands. The advisory names no fix, so contact the vendor and restrict access.
What's affected
The CVE record says Soar Cloud HRD Human Resource Management System through version 7.3.2025.0408 is affected. The ZUSO ART advisory, dated 6 June 2025, gives the same range, names Soar Cloud System Co., Ltd. as the vendor, and scores the issue 9.9 on CVSS 4.0. Its mitigation line is to contact Soar Cloud for version updates.
There is no fixed version in the record or the advisory. A related deserialization issue in the file download function, CVE-2025-48780, was published the same day with the same range, so a vendor update should address both. Ask for confirmation of that.
The CVSS vector shows network reach, low complexity, no privileges and no user interaction. It is an HR product, so records about staff are what you are protecting.
How to check if you're exposed
First, find out whether you use the product. That includes hosted instances that a supplier runs for you. Ask your systems owner for the installed version, which is usually shown in the product's about screen or in vendor release information.
If it is 7.3.2025.0408 or earlier, you are in range. Then look at the upload feature. List recent files in the directories where the application stores uploads and look for types that do not belong, such as scripts or executables, and for files created at odd times:
find /path/to/uploads -type f -mtime -90 -ls | head -n 50
Replace the path with the real upload folder for your install. Review web server logs for upload requests from unfamiliar addresses. If the application runs on Windows, ask your server team for the equivalent check.
What to do now
- Ask Soar Cloud for a fixed build and written confirmation of the version that contains the fix.
- Limit network access to the application to the people who need it, using a VPN or allow list.
- Make sure the upload folder cannot execute files. On many web servers this means disabling script handling for that directory. Test this on a copy before you apply it.
- Review uploads and logs for signs of abuse. If you find some, treat the host as compromised, rotate credentials and inform your data protection contact.
- Keep a record of the vendor reply for audits.
Why it matters
The weakness is CWE-434, unrestricted upload of a file with a dangerous type. The application accepts a file and stores it where the web server can run it, or where another part of the application will process it as code. The advisory describes the result as remote execution of system commands through a malicious file.
Safe upload handling has a few steps. Check the type against an allow list, rename the file, store it outside the web root, and never let the upload directory run scripts. Products that skip these steps keep producing the same bug.
The issue is not in the CISA Known Exploited Vulnerabilities catalogue, and the advisory does not say it was exploited. With no patch to apply, network restriction and upload folder hardening are the controls available to you today.
Quick check
What does the vendor say about a fix?
The advisory only says to contact Soar Cloud for version updates. It names no fixed version.
What is the quickest protective step?
Restrict who can reach the application, and make sure the upload folder cannot run scripts, while you wait for a vendor update.
Sources
Last reviewed: 18 October 2026.
