CVE-2025-50688

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-50688
A command injection vulnerability exists in TwistedWeb (version 14.0.0) due to improper input sanitization in the file upload functionality. An attacker can exploit this vulnerability by sending a specially crafted HTTP PUT request to upload a malicious file (e.g., a reverse shell script). Once uploaded, the attacker can trigger the execution of arbitrary commands on the target system, allowing for remote code execution. This could lead to escalation of privileges depending on the privileges of the web server process. The attack does not require physical access and can be conducted remotely, posing a significant risk to the confidentiality and integrity of the system.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://medium.com/@Justinsecure/chained-rce-on-twistedweb-14-0-0-via-command-injection-and-unauthenticated-put-1aa657995b4e Exploit Third Party Advisory
https://twisted.org/documents/14.0.0/index.html Product
Configurations

Configuration 1 (hide)

cpe:2.3:a:twistedmatrix:twistedweb:14.0.0:*:*:*:*:*:*:*
History

06 Nov 2025, 18:35

Type Values Removed Values Added
First Time Twistedmatrix twistedweb
Twistedmatrix
Summary
  • (es) Existe una vulnerabilidad de inyección de comandos en TwistedWeb (versión 14.0.0) debido a una depuración incorrecta de la entrada en la función de carga de archivos. Un atacante puede explotar esta vulnerabilidad enviando una solicitud HTTP PUT especialmente manipulada para cargar un archivo malicioso (por ejemplo, un script de shell inverso). Una vez cargado, el atacante puede activar la ejecución de comandos arbitrarios en el sistema objetivo, lo que permite la ejecución remota de código. Esto podría provocar una escalada de privilegios en función de los privilegios del proceso del servidor web. El ataque no requiere acceso físico y puede ejecutarse de forma remota, lo que supone un riesgo significativo para la confidencialidad e integridad del sistema.
CPE cpe:2.3:a:twistedmatrix:twistedweb:14.0.0:*:*:*:*:*:*:*
References () https://medium.com/@Justinsecure/chained-rce-on-twistedweb-14-0-0-via-command-injection-and-unauthenticated-put-1aa657995b4e - () https://medium.com/@Justinsecure/chained-rce-on-twistedweb-14-0-0-via-command-injection-and-unauthenticated-put-1aa657995b4e - Exploit, Third Party Advisory
References () https://twisted.org/documents/14.0.0/index.html - () https://twisted.org/documents/14.0.0/index.html - Product

05 Aug 2025, 20:15

Type Values Removed Values Added
CWE CWE-77
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5

05 Aug 2025, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-05 18:15

Updated : 2025-11-06 18:35

NVD link : CVE-2025-50688

Mitre link : CVE-2025-50688

CVE.ORG link : CVE-2025-50688

JSON object : View

Products Affected

twistedmatrix

  • twistedweb
CWE
CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')