CVE-2025-55743: UnoPim Remote Code Execution via Arbitrary File Upload
Summary
CVE-2025-55743: UnoPim vulnerable to remote code execution through Arbitrary File upload. Affects unopim/unopim versions < 0.2.1. Fixed in 0.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
UnoPim is a package available on Packagist that provides functionalities for user management, including user creation and profile picture uploads. This package is widely used in applications that require user registration and management. However, it has a critical vulnerability that allows attackers to upload malicious files disguised as images, leading to remote code execution on the server.
Vulnerability Detail
The vulnerability arises from the image upload functionality during user creation, which only performs client-side file type validation. An attacker can intercept the upload request using tools like Burp Suite, modify the file extension and content to upload a PHP file instead of a legitimate image. This allows the attacker to execute arbitrary commands on the server by accessing the uploaded file directly. The potential ramifications include full system compromise, unauthorized access to sensitive data, and control over the server environment.
How To Fix
Minimum fixed version
0.2.1
This is the first release that contains the fix.
composer require unopim/unopim:0.2.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict file uploads by validating the file extension on the server side. Here is a sample code snippet to validate the file extension in PHP:
$allowed_extensions = ['jpg', 'jpeg', 'png', 'gif'];
$file_extension = pathinfo($_FILES['image']['name'], PATHINFO_EXTENSION);
if (!in_array($file_extension, $allowed_extensions)) {
die('Invalid file type.');
}
Conclusion
The UnoPim package has a critical vulnerability (CVE-2025-55743) that allows remote code execution through improper file upload validation. It is essential to update to the latest version to mitigate this risk and implement additional security measures to protect your application.
See every vulnerability recorded for unopim/unopim →
FAQ
CVE-2025-55743 is a vulnerability in the UnoPim package that allows remote code execution through arbitrary file uploads.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to test your application without signup.
The consequences include potential full system compromise, unauthorized access to sensitive data, and the ability to execute arbitrary commands on the server.
You can update the UnoPim package to the patched version by running the command composer update unopim/unopim in your terminal.
If an immediate update is not possible, implement server-side validation for file uploads to restrict allowed file types as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for unopim/unopim.
