CVE-2025-29866: Tagfree X-Free Uploader

High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days.

: External Control of File Name or Path vulnerability in TAGFREE X-Free Uploader XFU allows : Parameter Injection.This issue affects X-Free Uploader: from 1.0.1.0084 before 1.0.1.0085, from 2.0.1.0034 before 2.0.1.0035.

Affected products

• Tagfree X-Free Uploader: from 1.0.1.0084, before 1.0.1.0085 (fixed in 1.0.1.0085); from 2.0.1.0034, before 2.0.1.0035 (fixed in 2.0.1.0035)

Published 2025-08-07. Last modified 2026-06-17.