CVE-2025-8344 is a medium severity unrestricted file upload flaw (CVSS 6.3) in Viglet Shio up to 0.3.8. The filename argument of the static file upload function does not limit what can be stored. No fixed version is confirmed in the sources reviewed, so check the project issue tracker and restrict access.
What's affected
Affected: openviglet Viglet Shio, versions up to 0.3.8, per the NVD record. The weak spot is shio-app/src/main/java/com/viglet/shio/api/staticfile/ShStaticFileAPI.java (function shStaticFileUpload), driven by the filename argument.
The record scores this 6.3 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. The CNA description (VulDB) calls it "critical", which is VulDB's own rating wording and not the CVSS band. Both are stated here; this post uses the CVSS score.
Fixed versions: none confirmed. The sources I reviewed (the NVD record) do not name a patched release or a vendor advisory. Check the vendor or project site for a newer release before assuming a fix exists.
The record lists the weakness as CWE-284 and CWE-434 (unrestricted upload of a dangerous file type). Gold has the full entry for CVE-2025-8344.
Exploitation status: the record says the exploit details have been disclosed publicly and could be used. CVE-2025-8344 is not listed in the CISA Known Exploited Vulnerabilities catalog per the record, and none of the pages I read claims exploitation in the wild.
How to check if you're exposed
Shio is a Java project, so check the version your build uses.
# Maven
mvn dependency:tree | grep -i shio
# Gradle
gradle dependencies | grep -i shio
# a deployed jar
find / -name "shio*.jar" 2>/dev/null
Anything at 0.3.8 or earlier falls inside the range in the record. Then read the code around ShStaticFileAPI.java in your copy and see whether the file name value is checked before it is used. You can also paste a manifest into the free in-browser dependency scan to see what else is outdated.
What to do now
- Limit who can reach the Shio static file upload endpoint. Require authentication and a network allow list.
- Check the project issue tracker and releases for a version newer than 0.3.8 and read its notes before upgrading.
- If you maintain a fork, allow only the file types you need, set the stored name yourself, and store uploads outside any folder the server executes.
- Run the Shio process as a low privilege user and keep the upload folder non executable.
- Look through the upload folder for files you do not recognize, and review access logs for unexpected upload requests.
Why it matters
Unrestricted upload means the server accepts a file without enough checks on its name, type or destination. The record maps this to CWE-284 and CWE-434. What an uploaded file can do depends on where it lands and how the server treats it, which is why the mitigations focus on storage location and permissions.
The CVSS score is 6.3, and the vector shows it needs some privileges. That lowers the urgency compared with an unauthenticated flaw, but any account able to upload could be a way in, so treat upload endpoints as sensitive.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a patched version of Viglet Shio?
None is confirmed in the sources reviewed. The NVD record lists up to 0.3.8 as affected, and no vendor advisory was found. Check the vendor site before relying on any fix.
Is CVE-2025-8344 being exploited in the wild?
The record does not mark it as a known exploited vulnerability, and no advisory I read says so. The record does say exploit details were disclosed publicly, so assume that attackers can reproduce it.
Sources
- Safeguard Gold entry for CVE-2025-8344
- NVD record data for CVE-2025-8344, published 2025-07-31, CVSS 6.3
Last reviewed: 18 October 2026.
