CVE-2025-11318 is a high severity (7.3) unrestricted file upload flaw in Tipray Data Leakage Prevention System 1.0. The File argument handled by uploadWxFile.do accepts content it should refuse. The record lists no fixed version, so limit network access to the product and ask the vendor for a patch.
What's affected
The record lists Tipray Data Leakage Prevention System version 1.0. The affected code is the file uploadWxFile.do, which takes an argument called File. CVSS 7.3 (high severity), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.
Fixed versions: none are named in the record, which also says the vendor was contacted early and did not respond.
How to check if you're exposed
First find out whether you run it at all. Search your asset list, container images and web roots for Tipray Data Leakage Prevention System. On a Linux host you can look for the vulnerable file name directly.
find / -name "uploadWxFile.do" -not -path "/proc/*" 2>/dev/null
Review the directory where uploaded files land. Look for files with executable or script extensions, or anything created at times nobody can explain. Check web server logs for requests to the upload endpoint from unfamiliar addresses.
A dependency scan helps with the inventory part. The free in-browser scan at gold.safeguard.sh/scan lists the libraries in a manifest you paste in. It will not find a hobby PHP application that was never packaged, so keep a plain list of what you host too.
What to do now
- Restrict network access to the product to the people who need it. A data protection system should not face the open internet.
- Contact the vendor for a patch and ask for written confirmation of the fix status, since the record says the vendor did not respond to the researcher.
- At the web server, stop script execution in the upload directory and block risky extensions until a fix is available.
- Review the upload directory for unexpected files and remove them after taking a copy for investigation.
- Watch for new child processes started by the web service account.
Why it matters
The record classes this as CWE-284 (improper access control), CWE-434 (unrestricted file upload). A server that stores uploaded files without checking their type, name and location can end up holding a file it will later run or serve.
The record says the exploit is public and the vendor did not respond. It is not listed on CISA KEV in the record. The practical risk depends on whether uploaded files can be reached and executed on your host.
Quick check
Is there a patched version?
The CVE record names none, and says the vendor did not respond. Ask the vendor directly and limit network access.
Is blocking file extensions enough?
Not alone. Also stop the upload directory from running scripts, and check content type and file names on the server side.
Sources
Last reviewed: 19 October 2026.
