AvePoint DocAve/Perimeter/Compliance Guardian Unrestricted File Upload Vulnerability (CVE-2025-10544)

Key Information Vulnerability Title: Unrestricted uploading of dangerous file types to AvePoint products Release Date: 26/09/2025 Identifier: INCIBE-2025-0520 Severity: 4 - High Affected Resources DocAve 6.13.2 Perimeter 1.12.3 Compliance Guardian 4.7.1 and earlier versions Description INCIBE coordinated the release of a high-severity vulnerability affecting AvePoint’s DocAve, Perimeter, and Compliance Guardian products. These products manage and back up content in SharePoint/M365, control and protect data access in the cloud, and classify and securely handle sensitive information to meet regulatory compliance requirements. The vulnerability was discovered by Chetani Mesa Guzman and Marcos Diaz Castineiras. This vulnerability has been assigned the following identifiers: CVE-2025-10544: CVSS v4.0: 8.6 Remediation Upgrade to the latest version of DocAve (6.13.3): - DocAve 6.13.3 Manager installation package: 6.13.3 manager package. - DocAve Agent 6.13.3 installation package: Agent Package 6.13.3. - DocAve 6.13.3 update package: Update Package 6.13.3. Upgrade to the latest version of Perimeter (1.12.4): - Perimeter 1.12.4 Administrator and Agent installation package: Package 1.12.4. - Perimeter 1.12.4 update package: Update package 1.12.4. Install the patch on the Compliance Guardian Manager server: - Compliance Guardian Manager patch: Compliance Guardian Manager patch. Details CVE-2025-10544: An unrestricted file upload vulnerability in DocAve 6.13.2, Perimeter 1.12.3, and Compliance Guardian 4.7.1 and earlier versions allows administrator users to upload files without proper validation. Attackers can exploit this vulnerability by uploading malicious files to compromise the system. Additionally, it is vulnerable to path traversal, which allows file writes to any directory within the web root. CWE Reference List DocAve, Compliance Guardian, and Perimeter Security Notice

Goal Reached Thanks to every supporter — we hit 100%!

AvePoint DocAve/Perimeter/Compliance Guardian Unrestricted File Upload Vulnerability (CVE-2025-10544)

More from this source