CVE-2025-34096 PUBLISHED

Easy File Sharing HTTP Server 7.2 Buffer Overflow via POST to /sendemail.ghp

Assigner: VulnCheck
Reserved: 15.04.2025 Published: 10.07.2025 Updated: 11.07.2025

A stack-based buffer overflow vulnerability exists in Easy File Sharing HTTP Server version 7.2. The flaw is triggered when a crafted POST request is sent to the /sendemail.ghp endpoint containing an overly long Email parameter. The application fails to properly validate the length of this field, resulting in a memory corruption condition. An unauthenticated remote attacker can exploit this to execute arbitrary code with the privileges of the server process.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 9.3

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	None
Attack Complexity	Low	Integrity	High	Integrity	None
Attack Requirements	None	Availability	High	Availability	None
Privileges Required	None
User Interaction	None

CVSS 4.0

Product Status

Vendor	EFS Software Inc.
Product	Easy File Sharing HTTP Server
Versions	Default: unknown Version 7.2 is affected

Credits

bl4ck h4ck3r finder

References

Problem Types

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer CWE

Impacts

CAPEC-10 Buffer Overflow via Environment Variables
CAPEC-137 Parameter Injection