CVE-2025-9775 is a high severity unrestricted file upload flaw (CVSS 7.3) in RemoteClinic, up to 2.0. The image argument of /staff/edit-my-profile.php lets a remote user submit a file that is not properly restricted. I could not confirm a fixed version, so restrict uploads, review the code and check for updates.
What's affected
The record lists RemoteClinic up to 2.0 as affected. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, which describes a network attack with low complexity that needs no privileges and no user interaction.
Fixed versions: I could not confirm one. The record and the reporter's page I read describe the flaw in the project's published source and do not point to a patched release. Check the vendor's download page and the project listing before assuming a fix exists.
How to check if you're exposed
Find out whether you run RemoteClinic and which version. The record covers versions up to 2.0.
find /var/www -type d -iname "*remote*clinic*" 2>/dev/null
find /var/www -path "*staff*" -name "*.php" -newer /var/www/index.php 2>/dev/null
The second command lists PHP files under staff folders that are newer than the site index, which is a quick way to spot a script that should not be in an upload directory. Adjust paths to your install.
Also look in the access log for POST requests to /staff/edit-my-profile.php followed by a GET to a file you do not recognise in an upload folder.
For application code you build or deploy, the free in-browser dependency scan at gold.safeguard.sh/scan covers your third party packages, and the Gold directory lets you look up a CVE like this one by id. Neither replaces reading hand written code, so pair them with a code review of query and upload handling.
What to do now
- Take the app off the public internet or restrict it to a VPN. Assume no patch is coming, since I could not confirm a fixed release.
- Disable script execution in the upload folder at the web server level, so a stored file cannot run even if it gets there.
- Review upload folders for files that are not images and remove anything you cannot account for.
- If you keep the app, add server side checks that match file content, not just the name, and store uploads outside the web root.
- Plan a move to a maintained product, especially since clinic software is meant to hold health related records.
- Review access logs for the staff edit pages and rotate credentials for staff accounts.
Why it matters
The weakness is CWE-284 (Improper Access Control) and CWE-434 (Unrestricted File Upload). The app accepts a file through the image field and does not restrict what kind of file it stores or where. If a script lands in a folder the web server executes, an upload turns into remote code execution.
The affected page accepts a file in the image field. Upload handlers that trust the file name or type the browser reports can end up storing files the application never meant to accept.
The record says an exploit has been made public. This CVE is not in the CISA Known Exploited Vulnerabilities catalog, and nothing I fetched reports attacks in the wild. A related RemoteClinic record, CVE-2025-9772, describes the product as no longer supported, so do not count on a patch.
Quick check
Is there a patched version of RemoteClinic?
The record says the product is no longer supported by its maintainer, so no patch should be expected. Plan to remove or replace it.
Why is an upload flaw serious?
A stored script in an executable folder can run on the server. Blocking execution in the upload directory limits the damage even before you fix the code.
Sources
- Gold page for CVE-2025-9775
- NVD record data for CVE-2025-9775, as held in the Safeguard content batch
- Reporter write-up: https://github.com/diy777/cve/issues/2
Source note: the only advisory material I could read for this CVE is a public GitHub issue from the reporter, which I fetched. It is a researcher report, not a vendor advisory, and it does not name a fixed version.
Last reviewed: 18 October 2026.
