# CVE-2025-24815: Nokia MantaRay NM unrestricted file upload

Source: https://junglewise.ai/threats/cve-2025-24815-nokia-mantaray-nm-unrestricted-file-upload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-30. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2025-24815 · Severity: info · Published 2026-06-30

Nokia MantaRay NM, a network management solution, contains a security flaw that allows users to upload unauthorized files. An attacker with valid login credentials could exploit this to place malicious software on the system. This could lead to a compromise of the management platform and potentially impact the stability of the managed network infrastructure.

Technologies: [Nokia MantaRay NM](https://junglewise.ai/threats/technologies/mantaray-nm). Vendors: [Nokia](https://junglewise.ai/threats/vendors/nokia).

## Quick answers

**Is CVE-2025-24815 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-24815 being exploited in the wild.

**How severe is CVE-2025-24815?** Informational severity, published 30 June 2026.

**Which products and versions are affected?** Nokia MantaRay NM < 25R2-NM.

**Is there a fix for CVE-2025-24815?** A patch was published on 2026-06-30: Version 25R2-NM listed as unaffected Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-24815 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-24815?** Check whether you run Nokia MantaRay NM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An unrestricted file upload vulnerability exists in Nokia MantaRay NM due to insufficient validation of file types during the upload process. An authenticated attacker can exploit this flaw by uploading arbitrary files, potentially including malicious scripts or executables, to the server. The vulnerability is reachable over the network but requires valid authentication credentials. If the uploaded files are stored in a web-accessible directory or executed by the system, it could lead to remote code execution (RCE). The issue is addressed in version 25R2-NM and later.

## Affected products

- Nokia MantaRay NM < 25R2-NM

## Timeline

- 2026-06-30: advisory: NVD publication date
- 2026-06-30: patched: Version 25R2-NM listed as unaffected

## References

- [https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2026-24815/](https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2026-24815/)

## Related threats

- [Nokia MantaRay NM sudo privilege escalation](https://junglewise.ai/threats/cve-2025-7406-nokia-mantaray-nm-sudo-privilege-escalation)
- [Nokia MantaRay improper access control in API](https://junglewise.ai/threats/cve-2025-24816-nokia-mantaray-improper-access-control-in-api)
- [Nokia MantaRay NM is vulnerable to a Relative Path Traversal vulnerability due to improper validation of input…](https://junglewise.ai/threats/cve-2025-24819-nokia-mantaray-nm-is-vulnerable-to-a-relative-path-traversal)
- [Nokia MantaRay NM is vulnerable to an OS command injection vulnerability due to improper neutralization of special…](https://junglewise.ai/threats/cve-2025-24818-nokia-mantaray-nm-is-vulnerable-to-an-os-command-injection)
- [Nokia MantaRay NM is vulnerable to an OS command injection vulnerability due to improper neutralization of special…](https://junglewise.ai/threats/cve-2025-24817-nokia-mantaray-nm-is-vulnerable-to-an-os-command-injection)