ming-soft/mcms · Security
MCMS allows arbitrary file uploads in the ueditor component
- GHSA ID
- GHSA-3922-2r6r-r4fv
- CVE ID
- CVE-2025-29287
- Severity
- critical
- Published
- Updated
- CVSS
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
An arbitrary file upload vulnerability in the ueditor component of MCMS v5.4.3 allows attackers to execute arbitrary code via uploading a crafted file.
CWEs
- CWE-434 · Unrestricted Upload of File with Dangerous Type
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-29287 ↗
- https://gist.github.com/erdan111/38dcb5150b523436fe01249b2542f02f#file-cve-2025-29287 ↗
- https://gitee.com/mingSoft/MCMS/issues/IBOOTX ↗
- https://gitee.com/mingSoft/MCMS/commit/17679d8fae3df2b433478829b01ab05a56ffdbc8 ↗
- https://github.com/advisories/GHSA-3922-2r6r-r4fv ↗