High · 7.8 CVE-2025-54564 EUVD-2025-23393GHSA-cvrx-jhp7-38jf

uploadsm in ChargePoint Home Flex 5.5.4.13 does not validate a user-controlled string for bz2 decompression, which allows command execution…

Published Aug 1, 2025 · Updated Aug 1, 2025 · Assigned by mitre

Description

uploadsm in ChargePoint Home Flex 5.5.4.13 does not validate a user-controlled string for bz2 decompression, which allows command execution as the nobody user.

References

https://github.com/koharin/CVE/blob/main/CVE-2025-54564