CVE-2025-29865: Tagfree X-Free Uploader

High severity, CVSS 8.7. EPSS: 0.4% chance of exploitation in the next 30 days.

: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TAGFREE X-Free Uploader XFU allows Path Traversal.This issue affects X-Free Uploader: from 1.0.1.0084 before 1.0.1.0085, from 2.0.1.0034 before 2.0.1.0035.

Affected products

• Tagfree X-Free Uploader: from 1.0.1.0084, before 1.0.1.0085 (fixed in 1.0.1.0085); from 2.0.1.0034, before 2.0.1.0035 (fixed in 2.0.1.0035)

Published 2025-08-07. Last modified 2026-06-17.