CVE-2025-54944 is a critical unrestricted file upload flaw in SUNNET Corporate Training Management System before version 10.11. Remote attackers can write malicious code into a specific file, which may lead to arbitrary code execution. Get version 10.11 or later from SUNNET Technology and restrict network access until then.
What's affected
- Product: SUNNET Corporate Training Management System, from SUNNET Technology Co., Ltd.
- Affected: versions before 10.11.
- Fixed: version 10.11 or later, per the version boundary in the record. The researcher's advisory says to contact SUNNET Technology for version updates, so ask the vendor for the current release and installation steps.
- What it allows: remote attackers can write malicious code in a specific file, which may lead to arbitrary code execution.
This is one of five related findings published together by the same researcher team (CVE-2025-54942 through CVE-2025-54946). They affect the same product and the same version range, so one upgrade addresses all of them. Plan the work as a single change.
How to check if you're exposed
This is a vendor application, so check it where it is installed.
- Find the product version in the administration pages or the installer record, and compare it with 10.11.
- Ask your SUNNET Technology contact which release you are on and whether all five advisories are covered.
- Check whether the system is reachable from the internet. A training portal often is, because staff and contractors use it from outside.
- Look at web server logs for unusual requests to deployment or upload functionality from addresses you do not recognize.
Because the vendor ships it as a packaged system, a library scan will not see it. Add it to your asset inventory with an owner and a patch contact.
What to do now
- Contact SUNNET Technology and obtain version 10.11 or later, with the vendor's upgrade instructions.
- Take a backup of the application and its database before you upgrade.
- If you cannot upgrade immediately, restrict access to the system to trusted networks or a VPN, and place a web application firewall in front of it if you have one.
- Review the server for files you did not put there, in particular in upload and deployment locations, and review logs back to the start of September 2025 at least.
- Record the upgrade and the check in your vulnerability tracker, covering all five related CVEs.
Why it matters
The weakness is unrestricted upload of a file with a dangerous type. If an application accepts files and does not control the type, name and destination, an uploaded file can end up somewhere the server will execute it. That turns a data feature into a code execution feature.
The usual defenses are an allowlist of file types checked by content rather than by extension, storing uploads outside any directory the web server executes, random server-side file names, and no execute permission on the upload location. Because the researcher's advisory scores this entry lower on CVSS 4.0 than the NVD record does on 3.1, expect different labels in different tools. The fix is the same.
The researcher's advisory (ZA-2025-12) lists the mitigation as contacting the vendor for version updates, and gives no workaround. The CVE is not on the CISA KEV list.
The weakness is classed as CWE-434 (Unrestricted Upload of File with Dangerous Type). Severity in the CVE record: critical, CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Quick check
What should I look for on the server?
Files you did not create in upload, deployment or web root locations, especially script files with recent timestamps. Preserve them for investigation before deleting.
Why do the scores differ?
The researcher's advisory uses CVSS 4.0 and scores this one 6.9, while the NVD record uses CVSS 3.1 and scores it 9.8. Different versions of the scale weigh things differently.
Sources
Last reviewed: 18 October 2026.
