Skip to content

Using MD5 to Hash files may cause file upload conflicts | 使用MD5对文件进行Hash可能会导致文件上传冲突

Moderate
moyangzhan published GHSA-cv5r-73vf-8x7v Jan 4, 2025

Package

FileService.java

Affected versions

< 3.5.0

Patched versions

3.5.0

Description

Impact

Users who upload files may be impacted | 上传文件的用户

Patches

Upgrade to 3.5.0 | 修复版本:3.5.0

Workarounds

If you don't want to upgrade and find that the uploaded file is not the one you intended to upload, you can make slight adjustments to the file content to change its MD5 hash and then re-upload it. | 如果不想升级,并且当发现上传的文件不是自己要传的文件时,可以对文件内容稍做调整,使其MD5跟之前的不一致,然后重新上传

References

MD5: https://en.wikipedia.org/wiki/MD5
SHA-256: https://en.wikipedia.org/wiki/SHA-2

Severity

Moderate

CVE ID

CVE-2025-21604

Weaknesses

No CWEs