CVE-2025-11354 is a Medium severity (CVSS 6.3) unrestricted file upload flaw in code-projects Online Hotel Reservation System 1.0. The upload handling in /admin/addslideexec.php lets a remote user upload files without proper limits. The record names no fixed release, so lock down uploads, restrict access and ask the vendor for a patch.
What's affected
The record lists code-projects Online Hotel Reservation System 1.0. The affected file is /admin/addslideexec.php, and the argument named in the record is image. The weakness types are CWE-284 (improper access control) and CWE-434 (unrestricted upload of dangerous file types). The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, which means network reachable with a low privilege account needed.
The record says the exploit has been published. That is not the same as attacks being seen. The CVE is not in the CISA KEV catalog, and I found no advisory that reports use in the wild. Public exploit details still make scanning for the flaw easy, so exposed installs deserve attention.
No vendor advisory or fixed version is listed in the record, and I could not confirm one from the public issue report. Check the vendor's site, listed as a reference in the record, for updates.
How to check if you're exposed
First confirm you run this product. Look for the application folder on your web server and check the version in its readme, admin footer or release notes. The record only names 1.0, so treat other versions as unverified rather than safe.
Then look at where uploaded files go. From the application's root directory, these commands show the upload code and any directories that hold user files:
find . -name "addslideexec.php"
grep -rn "move_uploaded_file" --include=*.php .
find . -type d -iname "*upload*" -o -type d -iname "*image*"
Look inside the directories those commands find. Files with a script extension such as php in a folder that the web server can execute are a red flag. Compare the file list with what your staff actually uploaded.
What to do now
- Take the application off the public internet, or put it behind a VPN or an IP allow list.
- Block script execution in the upload directory. On Apache, a rule that disables PHP handling for that folder works. On nginx, do not pass files from that location to PHP.
- Change the upload code to accept only an explicit list of file types, check the content type on the server side, rename files on save and store them outside the web root.
- Require a logged in session with the right role before any upload endpoint runs.
- Review the upload folder for files you do not recognize and check web server logs for requests to them.
- Contact the vendor for a patch. If none is published, plan to replace the application.
Why it matters
Unrestricted upload is one of the more dangerous web flaws because the uploaded file ends up on the server. If the server will run it, the file becomes code. Even when it will not, a stored file can be used to host content or attack other users. The two weakness classes here, CWE-434 and CWE-284, point at missing checks on what may be uploaded and on who may upload.
The record scores it as a low privilege, network reachable flaw with limited impact, but upload bugs often matter more than the base score suggests. The deployment, such as whether the upload folder can run scripts, decides the real outcome.
Quick check
Is there a patched version of code-projects Hotel Reservation?
Not that the record shows. No fixed version is listed, so fix the query yourself or limit access until the vendor responds.
Is CVE-2025-11354 exploited in the wild?
The record says an exploit has been made public, which is different from reported attacks. The CVE is not in the CISA KEV catalog, and I found no advisory saying it is exploited. Public exploit details still raise the risk for exposed sites.
Sources
- Public issue report listed in the record
- NVD record for CVE-2025-11354 (description, CVSS vector, CWEs)
To find known issues in the open source libraries behind your own projects, run the free in-browser dependency scan.
Last reviewed: 19 October 2026.
