CVE-2025-12301 is a High severity (CVSS 7.3) unrestricted file upload flaw in code-projects Simple Food Ordering System 1.0. The photo parameter in /editproduct.php is not restricted properly. No fixed version is confirmed, so limit access to the app and add server-side file checks.
What's affected
The record names code-projects Simple Food Ordering System 1.0. The affected function sits in /editproduct.php, and the vulnerable input is the photo parameter that carries an uploaded image. According to the record the attack can be launched remotely and a public report exists.
Weakness classes: CWE-284 (Improper Access Control), CWE-434 (Unrestricted Upload of File with Dangerous Type).
The vector says no account is needed, which is why the rating is high. No fixed release is named in the record or its references, so do not assume one exists.
How to check if you're exposed
This is a PHP application installed by copying files to a server, so a package manager will not list it. Check the following:
- Search web roots for the file with
find /var/www -name "editproduct.php"and adjust the path for your host. - Look in the folder where product photos are stored. Anything that is not an image, such as a script or an unfamiliar file type, is a sign of a problem and the app host should be treated as suspect.
- Check web server logs for POST requests to /editproduct.php from addresses you do not recognize.
- Confirm whether the server is allowed to run scripts from the upload folder. If it is, the risk is much higher.
What to do now
- Remove the app from the public internet or put it behind a VPN until it is fixed.
- Configure the web server so the upload folder cannot execute scripts, and serve those files as static content only.
- In the code, check the file type on the server using the content and an allowlist of extensions such as jpg and png, rename uploaded files, and keep them outside the web root where you can.
- Search the upload folder for files that are not images and investigate the host if you find any.
- Look for a patched release from the vendor, or replace the app if none appears.
Why it matters
Unrestricted upload bugs let a visitor put a file on the server that the developer never meant to accept. When the server then treats that file as code, the result can be full control of the application. Even when it does not, uploaded files can fill disks or host content that harms your visitors.
The class is also listed under improper access control in this record. Both point to the same lesson: decisions about what a user may do should be made on the server, not by the form that the browser shows. The record reports a public disclosure but no exploitation in the wild, and the CVE is not in the CISA KEV catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does limiting upload types in the browser fix this?
No. Browser checks can be skipped by anyone who sends the request directly. The checks must run on the server.
Sources
- Safeguard Gold entry for CVE-2025-12301
- NVD record for CVE-2025-12301 (published 27 October 2025), the basis for the scores, weakness classes and affected product data above
References listed in the NVD record (third-party reports and the vendor home page; no vendor advisory with a fixed version was confirmed):
- https://code-projects.org/
- https://github.com/underatted/CVE/issues/22
- https://vuldb.com/?ctiid.329973
- https://vuldb.com/?id.329973
- https://vuldb.com/?submit.676087
Last reviewed: 19 October 2026.
