Executive brief
A security vulnerability exists in the Hub v2.0 property management platform that allows unauthorized users to upload malicious files to the server. By exploiting this flaw, an attacker could upload and host dangerous content, such as malicious PDF documents, which can then be distributed to other users. This could lead to unauthorized access to sensitive information or the execution of malicious code on the system.
Technical details
An unrestricted file upload vulnerability (CWE-434) exists in the /utils/uploadFile component of Hubert Imoveis e Administracao Ltda Hub v2.0 version 1.27.3. The vulnerability stems from a lack of proper file type or extension validation on the backend when users upload account avatars. While some dangerous extensions like PHP or HTML are reportedly blocked, the system fails to validate the content of other formats, allowing attackers to upload crafted PDF files. These files are stored on the server and accessible via direct links, which can be used to facilitate remote code execution or phishing attacks against other users. The attack can be performed over the network without requiring high privileges.
Affected products
- Hubert Imoveis e Administracao Ltda Hub v2.0 1.27.3
Timeline
- 2025-11: disclosed: Vulnerability discovered by Carlos Artmann
- 2026-01-13: advisory: CVE published to NVD