CVE-2025-67077

—

CVSS 3.1

8.8 high

EPSS

<1%p31

Published

Jan 15, 2026 (Jan 15, 2026)

Modified

Jun 17, 2026

Description

File upload vulnerability in Omnispace Agora Project before 25.10 allowing authenticated, or under certain conditions also guest users, via the UploadTmpFile action.

Vendors: agora-project
Products: agora-project
Weakness: CWE-434
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.