CVE-2025-35032 is a low severity flaw (CVSS 3.4) in Medical Informatics Engineering Enterprise Health. Authenticated users can upload arbitrary files, and the impact depends on how files are later accessed. The CISA advisory says all instances were updated as of 2025-04-08 and no further action is required.
What's affected
The record says Enterprise Health allows authenticated users to upload arbitrary files and that the issue is fixed as of 2025-04-08. The CISA coordinated advisory VA-25-272-01 lists affected release branches such as RC202503, RC202409 and RC202403, each fixed on 2025-04-08.
The advisory covers several issues in the product, and this CVE is one of them. It describes the platform as an occupational electronic health record system. Its recommended practice reads that all instances have been updated as of 2025-04-08 and no further action is required to mitigate these vulnerabilities.
How to check if you're exposed
This is a vendor operated or vendor managed fix, so there is no package command to run. Use these steps instead.
- Ask the vendor or your account contact to confirm that your Enterprise Health instance received the update dated 2025-04-08 or later.
- If you host it yourself, check the release information on your instance against the CISA advisory.
- Review upload settings and file handling rules in your environment as a precaution.
If the vendor cannot confirm your update date, treat that as a gap worth escalating. You can also run the free in-browser dependency scan at gold.safeguard.sh/scan and browse the Gold directory for related advisories.
What to do now
- Confirm in writing that your instance is at or past the 2025-04-08 update.
- Review which accounts can upload files and remove access that is not needed.
- Make sure uploaded files are stored outside any path the web server executes, and that they are not served with an executable type.
- Scan uploaded content with your normal malware controls.
- Keep the CISA advisory in your records for audit purposes.
Why it matters
The weakness is CWE-434, unrestricted upload of a file with a dangerous type. The record is honest about the risk: the impact depends on how files are accessed. An uploaded file that is only stored is mostly harmless. One that is served or executed can be much worse.
The low score reflects that an attacker needs a valid login first and that the vendor has already deployed the fix. This CVE is not on the CISA Known Exploited Vulnerabilities list, and the record does not report exploitation.
The case is a good reminder that hosted fixes still need confirmation. A patch applied by a vendor is only useful if you know it reached your tenant.
Quick check
Do I need to patch anything myself?
The CISA advisory says all instances were updated as of 2025-04-08 and no further action is required. Confirm that with your vendor for your instance.
Why is the severity low?
Exploitation needs an authenticated account, and the impact depends on how uploaded files are accessed.
Sources
Last reviewed: 18 October 2026.
