PT-2025-9992 · Publiccms · Publiccms

C0Rdxy

·

CVE-2025-25361

·

Published

2025-03-06

·

Updated

2025-07-02

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions PublicCMS version 4.0.202406
Description The issue is related to an arbitrary file upload vulnerability in the /cms/CmsWebFileAdminController.java component. This allows attackers to execute arbitrary code by uploading a crafted svg or xml file.
Recommendations For PublicCMS version 4.0.202406, consider restricting access to the /cms/CmsWebFileAdminController.java component until a patch is available. As a temporary workaround, avoid using the file upload functionality in this component to minimize the risk of exploitation.

Exploit

Fix

Unrestricted File Upload

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-25361

Affected Products

Publiccms