CVE-2025-8255 is a high severity (CVSS 7.3) unrestricted file upload in code-projects Exam Form Submission 1.0. The image parameter of /register.php accepts files without enough checks. Public exploit details exist and no fixed version is listed, so block script execution in the upload folder or retire the app.
What's affected
code-projects Exam Form Submission version 1.0, file /register.php, argument image. The record describes the flaw as unrestricted upload and says the exploit has been disclosed to the public.
The report says the upload accepts executable scripts. It does not say that a login is required, and registration pages are normally open to anyone, so treat it as reachable by visitors.
The report says the code checks neither the file extension nor the declared content type nor the file contents, and that uploaded files land in a web accessible folder where scripts can run. Those are the reporter's claims. I read them but did not test them.
The record scores the issue 7.3 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. The record's description calls it critical, which is the reporting source's wording, while the numeric score is in the high band. No fixed version is listed anywhere I looked.
How to check if you're exposed
Search your servers for the application and its upload folder.
find /var/www -name "register.php" 2>/dev/null
Look at what the upload folder contains. Any file ending in a script extension, such as php, in a folder that should only hold images is a warning sign.
find /var/www -path "*upload*" -name "*.php" 2>/dev/null
Adjust the path to your layout. Also check your web server configuration to see whether script execution is switched off for the upload directory. If scripts can run there, the risk in the report applies to you.
Check access logs for POST requests to /register.php and for later requests to files in the upload folder from unfamiliar addresses.
What to do now
- Find every copy of code-projects Exam Form Submission and take public facing ones offline or behind a VPN.
- Remove any script files from the upload folder and check the host for unknown files and processes if you find some.
- Disable script execution in the upload directory in the web server configuration.
- Change the code to accept only an allowlist of image types, check the file contents, and rename files on save.
- Store uploads outside the web root where possible.
- Run the web server under an account with minimal permissions.
Why it matters
The record lists CWE-434 (Unrestricted Upload of File with Dangerous Type) and CWE-284 (Improper Access Control). A site that lets users upload files must decide what kinds are acceptable and where they live. If it accepts anything and serves it from a folder that runs scripts, an upload turns into code on the server.
This class is old and well understood, and the fixes are cheap. The record does not flag this CVE as CISA KEV, and it makes no claim of attacks in the wild.
Quick check
Is there a patch for CVE-2025-8255?
No fixed version is listed in the record or the reporter page. The remedy is to change the code and the server configuration, or to retire the app.
What is the single best control?
Stop scripts from running in the upload folder. It limits the damage even if a bad file gets in, and you can do it without changing application code.
Sources
- CVE-2025-8255 on Safeguard Gold
- Reporter issue
- NVD record for CVE-2025-8255, published 2025-07-28
Last reviewed: 18 October 2026.
