High 8.7Published Nov 19, 2025

CVE-2025-34337eGovFramework <= 4.3.1 Unauthenticated Encryption Oracle via Web Editor Image Upload Endpoints

Updated under an hour ago (Oct 26, 2026, 2:20 PM ET)

Does this affect you?

It affects eGovFramework/egovframe-common-components. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for eGovFramework/egovframe-common-components

Exploited in the last 30 days

eGovFramework/egovframe-common-components versions up to and including 4.3.1 includes Web Editor image upload and related file delivery functionality that uses symmetric encryption to protect URL parameters, but exposes an encryption oracle that allows attackers to generate valid ciphertext for chosen values. The image upload endpoints /utl/wed/insertImage.do and /utl/wed/insertImageCk.do encrypt server-side paths, filenames, and MIME types and embed them directly into a download URL that is returned to the client. Because these same encrypted parameters are trusted by other endpoints, such as /utl/web/imageSrc.do and /cmm/fms/getImage.do, an unauthenticated attacker can abuse the upload functionality to obtain encrypted representations of attacker-chosen identifiers and then replay those ciphertext values to file-serving APIs. This design failure allows an attacker to bypass access controls that rely solely on the secrecy of encrypted parameters and retrieve arbitrary stored files that are otherwise expected to require an existing session or specific authorization context. KISA/KrCERT has identified this unpatched vulnerability as "KVE-2023-5281."

CVSS: 8.7 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness (CWE): CWE-345
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Deferred
Record last updated: Jul 27, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

eGovFramework/egovframe-common-components eGovFramework/egovframe-common-components egovframework_egovframe_common_components:egovframework_egovframe_common_components (from the name)	through 4.3.1	CNA record

References

References

https://www.egovframe.go.kr/eng/sub.do?menuNo=2	product
https://github.com/eGovFramework/egovframe-common-components	product
https://pierrekim.github.io/blog/2025-11-20-egovframe-2-vulnerabilities.html	technical-description, exploit
https://pierrekim.github.io/advisories/2025-egovframe.txt	technical-description, exploit
https://www.vulncheck.com/advisories/egovframework-unauthenticated-encryption-oracle-via-web-editor-image-upload-endpoints	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.