CVE-2025-51056: Vedo Suite Project Vedo Suite

High severity, CVSS 8.2. EPSS: 0.5% chance of exploitation in the next 30 days.

An unrestricted file upload vulnerability in Vedo Suite version 2024.17 allows remote authenticated attackers to write to arbitrary filesystem paths by exploiting the insecure 'uploadPreviews()' custom function in '/api_vedo/colorways_preview', ultimately resulting in remote code execution (RCE).

Affected products

• Vedo Suite Project Vedo Suite: version 2024.17 only

Published 2025-08-06. Last modified 2026-07-05.