CVE-2025-5178 is a medium severity (CVSS 6.3) unrestricted file upload in Realce Tecnologia Queue Ticket Kiosk (up to 20250517). The record says it can be attacked remotely by an account with a low privilege account. No fixed version is confirmed, so check the vendor and limit exposure.
What's affected
Realce Tecnologia Queue Ticket Kiosk versions up to 20250517 are affected. The vulnerable code is /adm/ajax.php (the Image File Handler component), and the input named in the record is files[]. The record names the image file handler and says the vendor was contacted and did not respond.
The record gives no patched release. The references are a VulDB entry and a researcher write-up, not a vendor advisory, so I cannot confirm that a fix exists. Check the vendor's site and release notes before you decide whether to wait or replace.
The same product has an admin login SQL injection entry, CVE-2025-5176. Kiosk software is often left running on a public network, so check whether yours is.
How to check if you're exposed
Confirm whether the product runs in your estate, and which version. Then look at where uploaded files land. On the server, list recently written files in the upload or temp directories the application uses and look for types that should not be there, such as scripts:
find /path/to/app -type f -mtime -30 \( -name "*.php" -o -name "*.jsp" -o -name "*.sh" \) 2>/dev/null
Replace the path with the real application root. Unexpected script files in an upload folder deserve an immediate look, and so does a web server setting that lets that folder run code.
Also review access logs for requests to /adm/ajax.php from addresses you do not recognise. Do not test systems you do not own.
You can also run the free in-browser dependency scan at gold.safeguard.sh/scan, which checks the packages your own projects use against the Gold directory. It will not find a commercial product installed on a server, so pair it with an inventory of what runs where.
What to do now
- Find every copy of this product and its version, including test and staging installs.
- Look for a fixed release from the vendor. If none exists, plan a replacement.
- Restrict access to the affected feature to the few accounts that need it, and remove unused accounts.
- Make sure the upload folder cannot execute scripts, and serve uploaded files from a separate host or storage bucket if you can.
- Review the upload folder and the logs for files and requests you cannot explain.
Why it matters
The record lists CWE-284 (Improper Access Control), CWE-434 (Unrestricted Upload of File with Dangerous Type). Unrestricted upload means the application accepts a file without properly checking its type, name or content, or without checking that the caller is allowed to send it. The access control class matters here because the upload feature should be limited to the right users and the right purpose.
When uploaded content can end up somewhere the server will run it, an upload bug can turn into code execution on the host. The record does not say how far this particular flaw goes, so read the advisory text, and do not assume the worst or the best.
The record says the exploit has been disclosed publicly. It does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild.
Quick check
Is there a fixed version of Queue Ticket Kiosk?
I could not confirm one. The record lists no fixed version, so check the vendor and plan a replacement if nothing is offered.
Does the attacker need an account?
The CVSS vector lists a low privilege account as the access required. That is a lower bar than it sounds when accounts are shared or never removed.
Sources
Last reviewed: 18 October 2026.
