Unrestricted file upload in CKEditor plugin for Redmine can enable server-side code execution

A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’ feature of the CKEditor v1.2.3 plugin for Redmine, which allows arbitrary files to be uploaded to the server.

• The CKEditor plugin for Redmine version 1.2.3 is listed as affected.
• The supplied record and inspected technical material do not provide a confirmed fixed release, coverage for other release branches, or conditions establishing that other versions are safe.
• The status of plugin versions other than 1.2.3 is therefore unknown from the available evidence.

The affected component is the CKEditor plugin for Redmine, specifically the Browse and upload images feature. Its upload type controls do not adequately prevent dangerous file types, allowing attacker-controlled content to be written to the server as an arbitrary file. The public technical report states that the original path of an uploaded file can be exposed; if the server maps that file to an executable handler, direct access can lead to code execution in a compatible configuration. The normalized record characterizes the issue as network-reachable, unauthenticated, and requiring no user interaction. The exact route, storage directory, server-side handler, and whether every Redmine deployment executes uploaded files remain unconfirmed.

The record describes network reachability with low attack complexity, no required privileges, and no user interaction. It also marks a public exploit as available; the public technical report demonstrates dangerous-file upload and potential code execution in a compatible test environment. The supplied evidence does not identify a campaign, victim, or confirmed exploitation in the wild beyond the demonstration. Successful exploitation still depends on the server's upload handling, file execution behavior, and reachability of the uploaded file.

The flaw allows arbitrary files to be placed on the server through the image-upload feature. Where uploaded files are handled by an executable server-side processor, the technical result may be code execution with the privileges of the Redmine or web server process, affecting system confidentiality, integrity, and availability. The impact does not necessarily extend beyond the affected host, and the practical privilege level depends on the service account and server configuration. The public report demonstrates code execution in a test environment, but does not establish higher privileges, internal network access, or the same outcome for every deployment.

• Attacker-controlled content can be placed on the application server instead of being limited to safe image files.
• If an uploaded file is processed as executable content by the web server or runtime, an attacker may execute code with the web service account's privileges. This outcome depends on server configuration and is not established for every deployment.
• Code execution could allow unauthorized data changes, access to information readable by the service account, or service disruption.
• Exposure of the original upload path increases the likelihood that an uploaded file can be accessed directly.

1. Identify and address every deployment running the CKEditor plugin for Redmine version 1.2.3. No exact fixed release is confirmed in the supplied evidence, so another version should not be treated as safe without vendor confirmation.
2. Temporarily disable or remove the Browse and upload images feature, or remove the plugin where operationally feasible, until reliable remediation guidance is available.
3. Evaluate compensating controls that prevent the upload directory from being processed as executable content and prevent uploaded files from being directly reachable except where required. These are defensive measures, not a confirmed vendor patch.
4. If unauthorized files, exposed upload paths, or signs of code execution are found, preserve evidence, investigate server changes, and assess whether credentials or data accessible to the service account may have been exposed.

• Inventory Redmine systems and identify deployments using redmine_CKEditor version 1.2.3.
• Check whether the Browse and upload images feature is enabled and review the file-type rules applied to uploads.
• Inspect upload storage for dangerous files, server-side scripts, or files inconsistent with an image-upload function.
• Review application responses and server logs for exposure of original upload paths and for direct requests to uploaded-file URLs.
• Monitoring requests to the image-upload feature and uploaded-file URLs is precautionary. The absence of suspicious log entries does not prove that a system is safe.