CVE-2025-11347 is a High severity (CVSS 7.3) unrestricted file upload flaw in code-projects Student Crud Operation 3.3. The upload handling in add.php lets a remote user upload files without proper limits. The record names no fixed release, so lock down uploads, restrict access and ask the vendor for a patch.
What's affected
The record lists code-projects Student Crud Operation 3.3. The affected file is add.php, in the Add Student and Edit Student pages, and the record names the move_uploaded_file function as the point of the flaw. The weakness types are CWE-284 (improper access control) and CWE-434 (unrestricted upload of dangerous file types). The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, which means network reachable with no login needed.
The record says the exploit has been published. That is not the same as attacks being seen. The CVE is not in the CISA KEV catalog, and I found no advisory that reports use in the wild. Public exploit details still make scanning for the flaw easy, so exposed installs deserve attention.
No vendor advisory or fixed version is listed in the record, and I could not confirm one from the public issue report. Check the vendor's site, listed as a reference in the record, for updates.
How to check if you're exposed
First confirm you run this product. Look for the application folder on your web server and check the version in its readme, admin footer or release notes. The record only names 3.3, so treat other versions as unverified rather than safe.
Then look at where uploaded files go. From the application's root directory, these commands show the upload code and any directories that hold user files:
find . -name "add.php"
grep -rn "move_uploaded_file" --include=*.php .
find . -type d -iname "*upload*" -o -type d -iname "*image*"
Look inside the directories those commands find. Files with a script extension such as php in a folder that the web server can execute are a red flag. Compare the file list with what your staff actually uploaded.
What to do now
- Take the application off the public internet, or put it behind a VPN or an IP allow list.
- Block script execution in the upload directory. On Apache, a rule that disables PHP handling for that folder works. On nginx, do not pass files from that location to PHP.
- Change the upload code to accept only an explicit list of file types, check the content type on the server side, rename files on save and store them outside the web root.
- Require a logged in session with the right role before any upload endpoint runs.
- Review the upload folder for files you do not recognize and check web server logs for requests to them.
- Contact the vendor for a patch. If none is published, plan to replace the application.
Why it matters
Unrestricted upload is one of the more dangerous web flaws because the uploaded file ends up on the server. If the server will run it, the file becomes code. Even when it will not, a stored file can be used to host content or attack other users. The two weakness classes here, CWE-434 and CWE-284, point at missing checks on what may be uploaded and on who may upload.
The public issue report for this CVE has a title that describes the problem as unauthenticated and as leading to remote code execution. The CVSS vector in the record tells a similar story, so treat it as high risk until you have fixed it.
Quick check
Is there a patched version of code-projects Student CRUD?
The record names no fixed release. Check the vendor's site, and apply the code level and network controls in this post in the meantime.
Is CVE-2025-11347 exploited in the wild?
The record says an exploit has been made public, which is different from reported attacks. The CVE is not in the CISA KEV catalog, and I found no advisory saying it is exploited. Public exploit details still raise the risk for exposed sites.
Sources
- Public issue report listed in the record
- NVD record for CVE-2025-11347 (description, CVSS vector, CWEs)
To find known issues in the open source libraries behind your own projects, run the free in-browser dependency scan.
Last reviewed: 19 October 2026.
