PT-2025-31000

CVE-2025-8226

Published

2025-07-27

Updated

2025-08-26

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions yanyutao0402 ChanCMS versions through 3.1.2

Description A vulnerability exists in yanyutao0402 ChanCMS that may lead to information disclosure. The issue is related to the manipulation of the accessKey/secretKey arguments within an unknown function of the /sysApp/find file. This allows for remote exploitation. The exploit has been publicly disclosed.

Recommendations Upgrade yanyutao0402 ChanCMS to version 3.1.3.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

CWE-284: Improper Access Control

Related identifiers