CVE-2025-9772 is a high severity unrestricted file upload flaw (CVSS 7.3) in RemoteClinic, up to 2.0. The image argument of /staff/edit.php lets a remote user submit a file that is not properly restricted. The record says the project is no longer supported, so remove or isolate the app.
What's affected
The record lists RemoteClinic up to 2.0 as affected. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, which describes a network attack with low complexity that needs no privileges and no user interaction.
Fixed versions: none. The record states that this product is no longer supported by its maintainer, so no patch should be expected.
How to check if you're exposed
Find out whether you run RemoteClinic and which version. The record covers versions up to 2.0.
find /var/www -type d -iname "*remote*clinic*" 2>/dev/null
find /var/www -path "*staff*" -name "*.php" -newer /var/www/index.php 2>/dev/null
The second command lists PHP files under staff folders that are newer than the site index, which is a quick way to spot a script that should not be in an upload directory. Adjust paths to your install.
Also look in the access log for POST requests to /staff/edit.php followed by a GET to a file you do not recognise in an upload folder.
For application code you build or deploy, the free in-browser dependency scan at gold.safeguard.sh/scan covers your third party packages, and the Gold directory lets you look up a CVE like this one by id. Neither replaces reading hand written code, so pair them with a code review of query and upload handling.
What to do now
- Take the app off the public internet or restrict it to a VPN. Assume no patch is coming, since the record says it is unsupported.
- Disable script execution in the upload folder at the web server level, so a stored file cannot run even if it gets there.
- Review upload folders for files that are not images and remove anything you cannot account for.
- If you keep the app, add server side checks that match file content, not just the name, and store uploads outside the web root.
- Plan a move to a maintained product, especially since clinic software is meant to hold health related records.
- Review access logs for the staff edit pages and rotate credentials for staff accounts.
Why it matters
The weakness is CWE-284 (Improper Access Control) and CWE-434 (Unrestricted File Upload). The app accepts a file through the image field and does not restrict what kind of file it stores or where. If a script lands in a folder the web server executes, an upload turns into remote code execution.
The affected page accepts a file in the image field. Upload handlers that trust the file name or type the browser reports can end up storing files the application never meant to accept.
The record says an exploit has been made public and that the product is no longer supported by the maintainer. This CVE is not in the CISA Known Exploited Vulnerabilities catalog, and nothing I fetched reports attacks in the wild. The lack of a maintainer is the bigger long term risk, because every future bug will go unpatched too.
Quick check
Is there a patched version of RemoteClinic?
The record says the product is no longer supported by its maintainer, so no patch should be expected. Plan to remove or replace it.
Why is an upload flaw serious?
A stored script in an executable folder can run on the server. Blocking execution in the upload directory limits the damage even before you fix the code.
Sources
- Gold page for CVE-2025-9772
- NVD record data for CVE-2025-9772, as held in the Safeguard content batch
Source note: the reporter's page linked in the record could not be read when I checked, so this post rests on the NVD record. It names no vendor advisory or fixed version.
Last reviewed: 18 October 2026.
