PT-2025-9978
CVE-2025-2032
·
Published
2025-03-06
·
Updated
2025-03-07
Description by
CVSS 4.0
5.1
MediumMetricsAV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
ChestnutCMS version 1.5.2
Description
A problematic vulnerability was found in the
renameFile function of the /cms/file/rename API endpoint. The manipulation of the rename argument leads to path traversal. The exploit has been publicly disclosed.Recommendations
For ChestnutCMS version 1.5.2, as a temporary workaround, consider disabling the
renameFile function until a patch is available. Restrict access to the /cms/file/rename API endpoint to minimize the risk of exploitation. Avoid using the rename argument in the affected API endpoint until the issue is resolved.Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾