CVE-2025-65783: 
NixOS vulnerability analysis and mitigation

CVE-2025-65783 is an arbitrary file upload vulnerability in the /utils/uploadFile component of Hubert Imoveis e Administracao Ltda Hub v2.0 1.27.3, a Brazilian real estate management platform. The flaw allows attackers to upload crafted files (including PDFs) that are stored and accessible via direct links, potentially enabling code execution or content abuse. It was discovered by security researcher Carlos Artmann in November 2025 and published on January 13, 2026. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical), assessed by CISA-ADP (Red Hat CVE, GitHub Advisory).

The root cause is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The /utils/uploadFile endpoint, used for uploading user avatars, fails to properly validate file types or extensions on the backend. While some dangerous file types (e.g., HTML, executable PHP) are blocked, the filter is incomplete — allowing unexpected file types such as PDFs to be uploaded and stored with attacker-controlled extensions. The uploaded files are then accessible via direct public URLs, which can be shared with other users. Exploitation requires only network access and a valid application or web account; no elevated privileges are needed (GitHub Advisory).

Successful exploitation allows an attacker to upload arbitrary files to the server at api-cadastro.hubert.com.br/api/v1/utils/uploadFile, which are then stored and publicly accessible via direct links. This can be leveraged for phishing campaigns by distributing malicious file links to other platform users, and depending on server configuration, could potentially enable remote code execution if executable file types bypass the incomplete filter. The vulnerability affects confidentiality, integrity, and availability at a high level, with the potential for unauthorized data access and server compromise (GitHub Advisory, Red Hat CVE).

No public exploit code or weaponized exploit kit has been identified beyond the researcher's advisory. The EPSS score is 0.017% (0.000170), indicating a low current probability of exploitation in the wild. There is no evidence of active in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack requires no authentication beyond a standard application account, lowering the barrier for exploitation (GitHub Advisory).

1. Reconnaissance: Identify a target instance of Hubert Hub v2.0 1.27.3 accessible at api-cadastro.hubert.com.br. Register or obtain a valid user account on the platform.
2. Locate the upload endpoint: Navigate to the user account avatar upload feature in the web or app interface, which sends requests to /api/v1/utils/uploadFile.
3. Craft a malicious file: Prepare a file with a dangerous payload (e.g., a PDF with embedded scripts, or another file type not blocked by the server's incomplete filter) and assign it a non-blocked extension.
4. Upload the file: Submit the crafted file via the avatar upload function. The backend does not validate the file type or extension, so the file is accepted and stored with the attacker-supplied extension.
5. Retrieve the direct link: After upload, obtain the public URL where the file is stored (using the filename avatar plus the provided extension).
6. Distribute or exploit: Share the direct link with other users for phishing or social engineering, or — if server-side execution is possible — trigger execution of the uploaded payload (GitHub Advisory).

• Network: Unusual POST requests to /api/v1/utils/uploadFile with non-image file types (e.g., .pdf, .js, .xml) in the request body; direct GET requests to avatar file URLs with unexpected file extensions from external IPs.
• File System: Presence of files named avatar.<unexpected_extension> (e.g., avatar.pdf, avatar.js) in the upload/storage directory on the server.
• Logs: Server access logs showing repeated upload attempts with varied file extensions to the /utils/uploadFile endpoint; access log entries for direct retrieval of uploaded non-image files by multiple distinct IP addresses.

The vendor (Hubert Imoveis e Administracao Ltda) has not publicly released a patched version as of the available information. Organizations using Hub v2.0 1.27.3 should implement strict server-side file type validation on the /utils/uploadFile endpoint, enforcing an allowlist of permitted MIME types (e.g., image/jpeg, image/png) rather than relying on a blocklist. Additionally, uploaded files should be stored outside the web root or served through a content-delivery mechanism that prevents direct execution, and file contents should be validated (not just extensions). Contact the vendor directly for an official patch or updated version (GitHub Advisory).