CVE-2025-67079

critical · 9.8

File upload vulnerability in Omnispace Agora Project before 25.10 allowing attackers to execute code through the MSL engine of the Imagick library via crafted PDF file to the file upload and thumbnail functions.

9.8

CVSS

0.4%

EPSS (exploit prob.)

37th

EPSS percentile

2026-01-15

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-434

Affected products

Vendor	Product	Affected versions
agora-project	agora-project	< 25.10

Check a specific version with /api/v1/cve/match.

References

https://www.agora-project.net
https://www.helx.io/blog/advisory-agora-project/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-67079