CVE-2025-63695

The vulnerability (CWE-434) is located in the /dzz/system/ueditor/php/controller.php script, which handles files uploaded through the UEditor editor. Lack of proper validation of the type and extension of uploaded files allows an attacker to upload an executable file (e.g., a PHP webshell) without needing permissions or user interaction. After successful upload, the malicious file can be executed by the web server.

An attacker can gain full control over the server through remote code execution (RCE), as well as steal, modify, or destroy data stored in the system (loss of confidentiality, integrity, and availability).

DzzOffice should be updated immediately to a version newer than 2.3.7 as soon as the vendor releases a patch. Until the patch is applied, it is recommended to restrict network access to the /dzz/system/ueditor/php/controller.php endpoint (e.g., through firewall rules or web server configuration) and disable file upload functionality in this feature. Patches available from the vendor should be applied according to the references.

DzzOffice version 2.3.7 and all earlier versions.