CVE-2025-6900 is a medium (CVSS 6.3) unrestricted file upload flaw in code-projects Library System 1.0. The image upload handled by /add-book.php is not restricted as it should be. The record names no fixed version, so restrict upload handling and execution, or retire the app.
What's affected
code-projects Library System version 1.0, per the record. The affected file is /add-book.php, in the book image code. The reported input is the image parameter in that file.
The record gives no authentication requirement beyond the CVSS vector, which lists privileges required as none. Treat /add-book.php (book image) as reachable by anyone who can reach the site until you confirm otherwise.
The NVD description calls this issue critical. That label comes from the reporting database. The CVSS 3.1 base score in the record is 6.3, which falls in the Medium (4.0 to 6.9) band, and this post uses that.
I could not confirm a fixed version. The record's references are the vendor site home page, a researcher's report on GitHub and VulDB entries, and none of them as listed in the record names a patched release. Check the code-projects site or your copy's source before relying on a newer build. The record also says the exploit details have been disclosed to the public. It does not say the flaw is exploited in the wild, and the CISA Known Exploited Vulnerabilities flag is false.
How to check if you're exposed
This is a downloadable sample style application, not a package from npm or PyPI, so there is no version command. Work from the files on disk and the web server logs.
Find the app and the upload handler. Adjust the web root to your server:
find /var/www -path "*add-book.php" 2>/dev/null
List what has been uploaded, and look for anything that is not an image. Script extensions such as php in an upload folder are a red flag:
find /var/www -type f \( -name "*.php" -o -name "*.phtml" \) -path "*upload*" 2>/dev/null
Check the access logs for requests to the handler:
grep "add-book.php" /var/log/apache2/access.log | tail -50
Do not test this on a system you do not own. If the app is internet facing and you cannot say who owns it, treat it as exposed.
What to do now
- Find every copy of Library System in your environment, including old test and demo servers.
- If the app is not needed, take it offline. It is the only complete fix when no vendor patch exists.
- If it must stay, remove it from the public internet, or put it behind a VPN or an allow list.
- Disable script execution in the upload folder at the web server level, and move uploads outside the web root if you can.
- Change
/add-book.phpto accept only a short allow list of image types, check the file content, and store files under random names. - Review the upload folder for files that should not be there. Keep a backup before you clean anything.
Why it matters
The weakness is unrestricted upload of a dangerous file type. The record lists CWE-434 (unrestricted upload of file with dangerous type) and CWE-284 (improper access control). When an upload feature does not check what it accepts, and the upload folder is served by the web server, a file that is not a picture can end up somewhere the server will run it.
The CVSS score of 6.3 reflects low impact on each of confidentiality, integrity and availability, as scored by the reporting database. Real impact depends on the server setup: whether uploads are stored under the web root, whether the server executes scripts there, and what the web server account can reach.
The standard defenses are an allow list of file types verified by content and not just by name, random server side file names, storing uploads outside the web root, and turning off script execution in upload folders. The researcher issue I fetched for a sibling CVE in this product family lists the same measures.
Try it with your own code
Library System is a standalone app, so a package scan will not find it. If the project sits in a repository, the free in-browser dependency scan at gold.safeguard.sh/scan can list the libraries it pulls in, and reachability analysis helps separate flaws your code really calls from those it does not. Source code like /add-book.php still needs a code review.
Quick check
Is there a patch for CVE-2025-6900?
The record does not name a fixed version, and I could not confirm one from the references. Check the vendor site, and plan on fixing the upload code yourself or removing the app.
Is blocking by file extension enough?
No. Names can be disguised, so verify content as well, rename files on the server, and stop the web server from running anything in the upload folder.
Sources
- Safeguard Gold entry for CVE-2025-6900
- https://code-projects.org/
- https://github.com/W2-l0mechan1c/CVE1/issues/1
- https://vuldb.com/?ctiid.314392
- https://vuldb.com/?id.314392
- https://vuldb.com/?submit.604504
Last reviewed: 18 October 2026.
