{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2025-70023", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-04-14T17:09:50.429Z", "dateReserved": "2026-01-09T00:00:00.000Z", "datePublished": "2026-04-14T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-14T17:09:50.429Z"}, "descriptions": [{"lang": "en", "value": "An issue pertaining to CWE-843: Access of Resource Using Incompatible Type was discovered in transloadit uppy v0.25.6."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/transloadi"}, {"url": "https://github.com/transloadit/uppy"}, {"url": "https://gist.github.com/zcxlighthouse/27926a85371ac5d2291f44903254753e"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}}, "dataVersion": "5.2"}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "An issue pertaining to CWE-843: Access of Resource Using Incompatible Type was discovered in transloadit uppy v0.25.6."}], "id": "CVE-2025-70023", "lastModified": "2026-04-14T18:16:41.677", "metrics": {}, "published": "2026-04-14T18:16:41.677", "references": [{"source": "cve@mitre.org", "url": "https://gist.github.com/zcxlighthouse/27926a85371ac5d2291f44903254753e"}, {"source": "cve@mitre.org", "url": "https://github.com/transloadi"}, {"source": "cve@mitre.org", "url": "https://github.com/transloadit/uppy"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Received"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.25.6"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "uppy", "vendor": "transloadit"}], "analysis": {"en": {"generated_at": "2026-04-14T19:34:10.488344+00:00", "value": {"mitigation_remediation": ["Upgrade Transloadit\u00a0Uppy to a version that resolves the type\u2011mismatch issue if one is available.", "Implement input validation on all uploads to ensure that only expected resource types are accepted before processing.", "Configure application monitoring to detect unexpected crashes or abnormal request patterns that could indicate exploitation attempts.", "Restrict access to the Uppy upload endpoint to trusted networks or users until a patch can be applied."], "summary": {"action": "Monitor", "impact": "Potential denial of service and data integrity impact"}, "threat_synthesis": {"affected_systems": "Transloadit\u00a0Uppy\u00a0v0.25.6 is identified as affected. No other vendor or product information is currently listed for this vulnerability. The issue is specific to the Uppy component used by Transloadit for handling uploads.", "description_and_impact": "The vulnerability arises from improper handling of resource types in Transloadit\u00a0Uppy\u00a0v0.25.6, causing a type mismatch that can lead to undefined behavior when the application processes mismatched data. This weakness is formally classified as CWE\u2011843, Access of Resource Using Incompatible Type. While the specific behavioral outcomes are not detailed in the advisory, type confusion can cause the application to crash, misinterpret data, or expose unexpected state, potentially disrupting service availability or compromising data integrity.", "risk_and_exploitability": "The CVSS base score, EPSS probability, and KEV status are not reported, leaving the overall risk level indeterminate. Because no official patch or workaround is cited in the provided references, an affected organization would need to rely on its own safeguards. The likely attack vector would involve an attacker interacting with the Uppy service\u2014most plausibly by supplying a crafted upload or request that triggers the type mismatch. The absence of a listed exploit in KEV suggests no publicly known active exploit, but the undefined behavior inherent in this class of bug warrants caution."}}}}, "created": "2026-04-15T14:41:09.665870+00:00", "title": "Incompatible Resource Type Handling in Transloadit\u00a0Uppy\u00a0v0.25.6", "updated": "2026-04-15T15:30:06.833274+00:00", "vendors": ["transloadit", "transloadit$PRODUCT$uppy"]}