CVE-2025-8120
BaseFortify
Publication date: 2025-09-30
Last updated on: 2025-11-26
Assigner: CERT.PL
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| widzialni | pad_cms | to 1.2.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists because the PAD CMS upload photo functionality uses a client-controlled permission check parameter, allowing an unauthenticated remote attacker to upload files of any type and extension without restriction. These uploaded files can then be executed, leading to Remote Code Execution. It affects all three templates: www, bip, and ww+bip.
How can this vulnerability impact me? :
The vulnerability can lead to Remote Code Execution by an unauthenticated attacker, which means an attacker can run arbitrary code on the affected system. This can result in full system compromise, data theft, service disruption, or further attacks within the network.
What immediate steps should I take to mitigate this vulnerability?
Since the product is End-Of-Life and no patches will be published, immediate mitigation steps include disabling or restricting the upload photo functionality to prevent unauthenticated file uploads, implementing network-level controls such as blocking access to the upload endpoint, and monitoring for any suspicious file uploads or executions. Consider migrating to a supported product version or alternative CMS to avoid exposure.