CVE-2025-15109
Unrestricted File Upload in jackq XCMS Remote Exploit
Publication date: 2025-12-27
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| jackq | xcms | 3fab5342cc509945a7ce1b8ec39d19f701b89261 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a flaw in jackq XCMS that allows unrestricted file upload through a specific PHP file (Public/javascripts/admin/plupload-2.1.2/examples/upload.php). An attacker can remotely exploit this flaw to upload files without restrictions, potentially leading to unauthorized actions on the system.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated attackers to upload arbitrary and potentially malicious files, leading to remote code execution and full system compromise. This can result in unauthorized access, data breaches, and loss of confidentiality, integrity, and availability of sensitive information. Such security failures can cause non-compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data against unauthorized access and breaches. [1, 2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking for the presence of the vulnerable upload endpoint at `Public/javascripts/admin/plupload-2.1.2/examples/upload.php`. You can use network scanning or web discovery tools to identify this URL on your system. Additionally, you can look for suspicious uploaded files, especially PHP files placed in unexpected directories due to directory traversal. A suggested command to detect the vulnerable URL using curl is: curl -I http://<target-host>/Public/javascripts/admin/plupload-2.1.2/examples/upload.php To find potentially malicious uploaded files, you can search your web root for recently modified or suspicious PHP files: find /var/www/html -type f -name '*.php' -mtime -7 Replace `/var/www/html` with your web root directory. Monitoring HTTP logs for unusual POST requests to the upload.php endpoint with multipart/form-data content can also help detect exploitation attempts. [1, 2, 3]
How can this vulnerability impact me? :
The vulnerability can allow an attacker to upload malicious files remotely without any restrictions. This can lead to unauthorized access, data compromise, or further exploitation of the system, potentially impacting the confidentiality, integrity, and availability of the affected system.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include disabling or restricting access to the vulnerable upload endpoint `Public/javascripts/admin/plupload-2.1.2/examples/upload.php` to prevent unauthenticated file uploads. Since no patches or updates are available due to the rolling release model and lack of vendor response, it is recommended to replace the affected component with an alternative product or remove the vulnerable upload functionality entirely. Additionally, implement strict validation on any file uploads, including checking file type, content, and extension, and restrict upload permissions to authenticated and authorized users only. Monitoring and blocking suspicious HTTP requests targeting the upload endpoint can also help reduce risk. [2]