External risk intelligence

Hub Arbitrary File Upload Vulnerability Allows Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-65783

The vulnerability exists in a file upload component of a web application. Such components are commonly exposed as part of public-facing web services or portals to allow user interaction, making it likely that this endpoint is reachable from the internet in standard deployments.

Unrestricted File Upload

Hubert Hub

2.0.1.27.3

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical security vulnerability found in a file upload feature within the Hubert Hub application. The flaw could allow unauthorized individuals to upload malicious files, potentially leading to the execution of arbitrary code on affected systems. Understanding the specific deployment and usage of this software within our environment is key to assessing any potential exposure.

File upload weakness allows code execution.
Confirms relevance and exposure to risk.
Assess deployment and potential impact.

Attack Path

How an attacker could exploit the issue

An attacker can target the file upload feature on the Hubert Hub application's web interface, which is accessible over the network. By uploading a specially crafted PDF file to the `/utils/uploadFile` component, an attacker could bypass security checks and achieve arbitrary code execution.

Entry Condition: No authentication required.
Trigger Point: Uploading a crafted PDF file.
Resulting Risk: Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary code on the server by uploading a malicious PDF file through a specific component. This could potentially lead to a compromise of the affected system's integrity and confidentiality.

Arbitrary code execution.
Uploading a crafted PDF file.
Server compromise, data loss, or denial of service.

Operational Fix

Recommended remediation, mitigation, and detection steps

Owners of web applications and the underlying infrastructure must prioritize this critical vulnerability. The first practical step is to locate all instances of the affected product, assess their external reachability and business criticality, and identify the accountable system owner. Subsequently, a remediation plan should be developed based on the determined risk.

Application owners and infrastructure teams.
Verify external reachability and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Hubert Hub software?

Hubert Hub v2.0 1.27.3 is a web-based application developed by Hubert Imoveis e Administracao Ltda. It includes utility components, such as a file upload feature, designed to manage administrative or property-related workflows. Because it functions as a server-side application, it processes incoming data from users to facilitate its operational tasks.

What does CWE-434 mean for CVE-2025-65783?

CWE-434 refers to Unrestricted Upload of File with Dangerous Type. In this context, it means the application does not sufficiently validate the contents or file extensions of uploads. Because the system fails to verify that a file is a safe PDF, it allows a malicious actor to substitute harmful code that the server then executes as if it were a legitimate part of the application.

How can an attacker trigger this vulnerability?

An attacker exploits this by sending a crafted PDF file to the /utils/uploadFile endpoint. The process does not require any prior authentication or special permissions. It is important to note that sending standard, non-malicious PDF files or accessing other parts of the application that do not involve this specific upload component will not trigger the flaw.

Is my Hubert Hub instance at risk?

According to Halo Surface Signal, this vulnerability is likely to be reachable from the internet. Because the file upload component is typically part of a public-facing portal or web service, systems that are exposed to the network are at the highest risk. You should check if your specific instance of Hubert Hub is configured to allow inbound connections from the internet.

What should I do if I run Hubert Hub?

Start by performing an inventory to locate every instance of the software within your environment. Once identified, evaluate the network placement of these servers to see if they are internet-facing. After assessing their business criticality and exposure, establish a plan with the relevant system owners to apply necessary updates or restrict access to the vulnerable upload component.

References

github.com/carlos-artmann/vulnerability-research/tree/main/CVE-2…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.