External risk intelligence

DzzOffice Arbitrary File Upload Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-63695

DzzOffice is a web-based collaboration and office software suite designed to be accessed via web browsers. As a web application, it is commonly deployed as an internet-facing service to facilitate remote access and collaboration, making the vulnerable file upload endpoint reachable from the public internet in typical deployment scenarios.

Unrestricted File Upload

Dzzoffice

2.3.7 and earlier

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This CVE relates to a critical vulnerability in DzzOffice, a web-based office software. The flaw allows for arbitrary file uploads through a specific system component, potentially enabling unauthorized code execution and data compromise. The main concern is confirming whether this specific software and version are in use within our environment.

Unrestricted file uploads in office software.
Critical flaw could allow unauthorized code execution.
Confirm relevance and exposure of this software.

Attack Path

How an attacker could exploit the issue

An attacker could exploit a vulnerability in DzzOffice by sending a specially crafted request to a specific file handling component. This could allow them to upload arbitrary files to the server, potentially leading to further compromise.

No authentication required to access.
Upload arbitrary files to the server.
Remote code execution and data compromise.

Live Threat

Current exploitation, exposure, and threat context

A critical vulnerability in DzzOffice could allow an unauthenticated attacker to upload arbitrary files to the system. This is possible when the vulnerable file upload functionality, specifically within the UEditor component, is accessible over the network. The consequence could be a compromise of the server's integrity.

Arbitrary code execution on the server.
File upload via a network request.
Server compromise and unauthorized access.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for DzzOffice deployments, likely application or platform owners, should first identify all instances of the affected software. Confirming the reachability and criticality of these instances will inform risk-based prioritization for remediation. Engage vendor management if the software was procured through a third party.

Application or platform owners should take ownership.
Verify external reachability and business criticality.
Plan coordinated remediation activities.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is DzzOffice?

DzzOffice is a web-based collaboration and office software suite. It provides users with a platform for cloud storage, file management, and document processing, typically deployed on servers to enable teams to work together remotely through a web browser.

How does CVE-2025-63695 happen?

This vulnerability is classified as Unrestricted Upload of File with Dangerous Type (CWE-434). It occurs because the software's UEditor component fails to properly validate or filter files being uploaded to the server. An attacker can use this flaw to send malicious files to the system, which may then be executed, leading to unauthorized control.

Do I need to be logged into DzzOffice to trigger this bug?

No. The vulnerability does not require authentication. An attacker can reach the affected file upload endpoint in controller.php without valid user credentials. The bug is triggered by sending a specific, crafted network request to the server, provided the UEditor component is active and reachable.

Is my DzzOffice instance at high risk?

Halo Surface Signal indicates that because DzzOffice is a web-based application designed for remote collaboration, it is frequently deployed with internet-facing access. If your instance is accessible from the public internet, it is more easily reached by potential attackers compared to services restricted to an internal, private network.

When should I prioritize fixing this DzzOffice issue?

You should prioritize this immediately if you are running version 2.3.7 or older. Start by conducting an inventory to locate all instances of DzzOffice in your environment. Once identified, verify if they are network-reachable, assess their business role, and initiate your standard patching or vendor update process to secure the affected file upload component.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.