CVE-2025-9173

CVE-2025-9173 is a security vulnerability that is still awaiting full analysis and scoring.

Key facts

Description

Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The file upload in include/service/media.php verifies the file extension based on a list defined in include/lib/option.php. This whitelist prevents unrestricted uploads (e.g. PHP files). Therefore, the attack possibility is just of theoretical nature.

Frequently asked questions

What is CVE-2025-9173?
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The file upload in include/service/media.php verifies the file extension based on a list defined in include/lib/option.php. This whitelist prevents unrestricted uploads (e.g. PHP files). Therefore, the attack possibility is just of theoretical nature.
Is CVE-2025-9173 being actively exploited?
It is not currently listed in CISA's Known Exploited Vulnerabilities catalog, and no EPSS exploit-prediction score is available yet.
How do I fix CVE-2025-9173?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-9173 have an EU (EUVD) identifier?
Yes. CVE-2025-9173 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-28822.
When was CVE-2025-9173 published?
CVE-2025-9173 was published on 2025-08-20 and last updated on 2026-01-08.