Listen to this Post
How the CVE Works
The CVE-2025-XXXXX vulnerability in `nova-tiptap` stems from inadequate security controls in the file upload endpoint /nova-tiptap/api/file. The endpoint lacks authentication checks, allowing unauthenticated users to submit POST requests. Attackers can manipulate the `disk` parameter to specify any Laravel storage disk (e.g., local, public, s3). The absence of file validation enables the upload of malicious files (.php, .js, etc.). If the disk is publicly accessible, attackers may achieve Remote Code Execution (RCE) by executing uploaded scripts or distributing malware. The CSRF token requirement is bypassable via crafted requests, making exploitation trivial.
DailyCVE Form
Platform: Laravel Nova
Version: <2.0.5
Vulnerability: Arbitrary File Upload
Severity: Critical
Date: Jul 21, 2025
Prediction: Patch by Aug 5, 2025
What Undercode Say
curl -X POST -F "[email protected]" -F "disk=public" http://target/nova-tiptap/api/file
// Exploit PoC
$response = Http::withToken($csrfToken)->attach('file', file_get_contents('shell.php'))
->post('http://target/nova-tiptap/api/file', ['disk' => 'public']);
How Exploit
1. Craft a POST request to `/nova-tiptap/api/file`.
2. Set `disk` to a writable, public-facing storage.
3. Upload a malicious file (e.g., web shell).
4. Access the file via the public URL.
Protection from this CVE
1. Apply authentication middleware.
2. Restrict file types/extensions.
3. Disable dynamic disk selection.
4. Update to patched version.
Impact
- Remote Code Execution (RCE)
- Data compromise
- Server takeover
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
