How severe is CVE-2025-14602?

CVE-2025-14602 has a CVSS 4.0 base score of 5.3, rated medium severity.

Is CVE-2025-14602 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (20th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2025-14602?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2025-14602 published?

CVE-2025-14602 was published on 2026-08-20.

CVE-2025-14602

CVE-2025-14602 is a medium-severity vulnerability with a CVSS 4.0 base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-340.

Key facts

Severity: Medium (CVSS 4.0 base score 5.3)
EPSS exploit prediction: 0% (20th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-340
Published: 2026-08-20
Last modified: 2026-08-20

Description

The application generates uploaded file names using a weak and predictable method based on the request timestamp. This allows a remote attacker to accurately guess or brute-force the generated filename within a short time window. An attacker can successfully locate and access uploaded files, which can be used to facilitate further attacks. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and on have the patch.

Frequently asked questions

What is CVE-2025-14602?: The application generates uploaded file names using a weak and predictable method based on the request timestamp. This allows a remote attacker to accurately guess or brute-force the generated filename within a short time window. An attacker can successfully locate and access uploaded files, which can be used to facilitate further attacks. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and on have the patch.
How severe is CVE-2025-14602?: CVE-2025-14602 has a CVSS 4.0 base score of 5.3, rated medium severity.
Is CVE-2025-14602 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (20th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2025-14602?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2025-14602 published?: CVE-2025-14602 was published on 2026-08-20.

References

https://github.com/klsecservices/Advisories/blob/master/KLSA-00294-Weak-File-Name-Generation-in-vsDesk.md

Other CWE-340 vulnerabilities

CVE-2025-69286 — Critical (CVSS 9.8): RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions prior to 0.22.0, the use of an…
CVE-2026-75106 — Critical (CVSS 9.1): OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt,…
CVE-2026-5081 — Critical (CVSS 9.1): Apache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 for Perl session ids are…
CVE-2026-2473 — High (CVSS 7.7): Predictable bucket naming in Vertex AI Experiments in Google Cloud Vertex AI from version 1.21.0 up to (but not…
CVE-2025-62294 — High (CVSS 7.5): SOPlanning is vulnerable to Predictable Generation of Password Recovery Token. Due to weak mechanism of generating…
CVE-2024-52299 — High (CVSS 7.5): macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Any user with view right on…

Browse all CWE-340 vulnerabilities →