Melis Platform CVE-2025-10353
CRITICALAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Melis CMS slider endpoint
-
DeliveryPOST malicious file via mcsdetail_img parameter
-
ExploitBypass file-type validation on upload
-
ExecutionStore webshell in webroot
-
PersistRequest uploaded file to execute code
-
ImpactRemote code execution as web server user
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Exploitation requires the target to run Melis Platform with the 'melis-cms-slider' module enabled and the back-office endpoint '/melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm' network-reachable. The attack is performed by POSTing a dangerous file (e.g., executable PHP) through the 'mcsdetail_img' parameter; successful RCE additionally depends on the uploaded file landing in a web-accessible, script-executable directory. LIMITING FACTORS: the provided vector states no authentication (PR:N) and no user interaction, but the endpoint is part of the CMS administrative/back-office interface, so in many deployments a valid authenticated session may in practice be required - this should be confirmed with the vendor/coordinator. There is no indication the vulnerable module is enabled by default in all installations. |
| Impact | Multiple signals align toward genuine priority but with important caveats. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H, score 9.3) describes an unauthenticated, network-reachable, low-complexity file-upload flaw yielding full confidentiality, integrity, and availability compromise - the classic profile of a reliable RCE. A public proof-of-concept exists (GitHub, ivansmc00), which lowers the barrier to opportunistic exploitation. However, countervailing signals temper the urgency: this is NOT listed in CISA KEV, so there is no confirmed active exploitation, and the EPSS score is only 2.66% (85th percentile) - elevated relative to the average CVE but far from the high-probability tier, consistent with a POC-available-but-not-yet-mass-exploited bug in a low-footprint product. A notable conflict: the CWE is tagged CWE-43 (Path Equivalence: multiple trailing dot), which does not match a file-upload-to-RCE weakness; the expected classification is CWE-434 (Unrestricted Upload of File with Dangerous Type) - verify with the coordinator (INCIBE). Additionally, the targeted endpoint path ('/melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm') sits within the Melis CMS back-office slider module, which in typical deployments is an authenticated admin area; the PR:N (unauthenticated) rating should be independently validated, as real-world exploitation may require a valid back-office session. Net: a real, POC-backed RCE worth prompt patching for anyone running Melis Platform, but its limited deployment footprint and absence from KEV make it a targeted rather than internet-wide emergency. |
| Exploit ScenarioDerived | An attacker sends a crafted multipart POST request to '/melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm' with a malicious file (e.g., a PHP webshell) supplied in the 'mcsdetail_img' parameter, which the slider module stores without adequate type/extension validation. The attacker then requests the uploaded file from the webroot to execute arbitrary code in the context of the web server. A public proof-of-concept is available, making this scenario readily reproducible; exploitation may, however, depend on reaching the back-office endpoint, which can require an authenticated session despite the CVSS PR:N rating. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Unauthenticated file upload in the melis-cms-slider module of Melis Technology's Melis Platform lets remote attackers push a dangerous file through the 'mcsdetail_img' parameter of a POST request to /melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm and, if that file is written into a web-accessible, script-executable directory, obtain remote code execution with the web server's privileges. Both the published CVSS v4.0 vector (9.3, AV:N/AC:L/AT:N/PR:N/UI:N, VC/VI/VA:H, SC/SI/SA:N) and the independent CVSS v3.1 assessment agree on network reachability, low attack complexity, no required privileges and no user interaction; because the affected route sits inside the CMS back-office, however, some deployments may in practice still require a valid authenticated session, a point that should be confirmed with the vendor or coordinator. Publicly available exploit code exists (a GitHub proof-of-concept) and EPSS is 2.66% (roughly the 85th percentile), but the CVE does not appear in CISA KEV, so active exploitation is not confirmed by the available intelligence.
RemediationAI
The provided intelligence does not include a vendor-released patch version or a fix commit for CVE-2025-10353, so the first action is to obtain current fixed-version guidance from the INCIBE advisory (https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-melis-platform) and from Melis Technology, then upgrade the platform and the melis-cms-slider module as directed. Where an upgrade cannot be applied immediately, combine the following compensating controls and accept their trade-offs: remove or disable the melis-cms-slider module entirely if slider functionality is not business-critical (this eliminates the attack surface but removes the feature); restrict network access to /melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm and to the wider /melis/ back-office to trusted management networks or VPN only (effective but breaks remote administration from untrusted networks); enforce authentication and authorization checks in front of the saveDetailsForm action, since the published PR:N rating on a back-office route is a discrepancy worth closing at the reverse proxy or WAF layer (adds a session prerequisite that some legitimate integrations may not satisfy); configure the upload destination so it is not script-executable, for example by storing uploads outside the document root or disabling PHP handling in that directory with Apache 'php_flag engine off' or a handler removal, or by using nginx try_files to deny script execution in upload paths (harmless to normal image serving, but requires configuration access and testing); and add WAF rules or file-type/MIME allowlisting that reject executable extensions and content on the 'mcsdetail_img' field (simple to deploy, though easily bypassed if the attacker controls both extension and content type). Detection should focus on POSTs to the saveDetailsForm endpoint, on newly written files under upload directories that carry script extensions, and on web server processes spawning unexpected child processes; the public proof-of-concept at https://github.com/ivansmc00/CVE-2025-10353-POC provides a concrete test case for validating whatever mitigation is chosen.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in composer
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Melis Platform is a PHP-based enterprise CMS/application platform whose functionality is split into installable modules, and melis-cms-slider is the module responsible for managing slider content; its MelisCmsSliderDetails controller exposes a saveDetailsForm action that accepts multipart form data and persists the image referenced by the 'mcsdetail_img' field. The advisory data maps the issue to CWE-43 (improper neutralization of special elements in output used by a downstream component), which frames the weakness as attacker-controlled input being passed unsanitized to a downstream consumer, where that consumer is the web server/file handler that later interprets the stored file; in practical terms the defect is an unrestricted upload of a file with a dangerous type, since filename, extension and content type on the 'mcsdetail_img' upload are not sufficiently validated before the file is written to disk. Code execution is conditional rather than automatic: the uploaded payload must land in a directory that is both reachable over HTTP and configured to execute scripts (for example PHP), which is a common default in CMS deployments but depends on the installation's document root and handler configuration. The CVSS v4.0 vector's AT:N (no attack requirements) and SC:N/SI:N/SA:N (no subsequent system impact) indicate the attacker needs no pre-existing conditions on the target and that the resulting compromise is confined to the vulnerable platform itself rather than cascading to connected systems; its threat and environmental metrics are left unset (E:X, CR:X, IR:X, AR:X), so those elements reflect undefined rather than assessed values. No CPE identifiers or explicit affected version ranges were supplied in the available intelligence, so exact version scoping must be taken from the vendor/INCIBE advisory. A public proof-of-concept implementation is available at https://github.com/ivansmc00/CVE-2025-10353-POC and can be used to validate detection and blocking controls.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-reachable low-complexity file upload yielding server-side code execution, so full C/I/A; PR:N retained per input vector though back-office endpoint context may warrant PR:L - scope unchanged.
Primary rating from Vendor (incibe).
CVSS VectorVendor: incibe
DescriptionCVE.org
File upload leading to remote code execution (RCE) in the “melis-cms-slider” module of Melis Technology's Melis Platform. This vulnerability allows an attacker to upload a malicious file via a POST request to '/melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm' using the 'mcsdetail_img' parameter.
Executive ViewAI
Melis Platform deployments using the melis-cms-slider module face a critical file-upload vulnerability (CVE-2025-10353) that can lead to remote code execution with the web server's privileges. Public exploit code is available and no vendor-released patch has been identified, so internet-exposed or weakly segmented CMS back-office environments are at elevated risk of compromise and potential lateral movement. Security leadership should prioritize immediate exposure reduction, vendor coordination, and monitoring because the flaw can affect the confidentiality, integrity and availability of the CMS and connected data.
No vendor-released patch identified at time of analysis. Interim mitigations: disable or remove the melis-cms-slider module if not required; block POST requests to /melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm and the mcsdetail_img parameter at the WAF or reverse proxy; restrict CMS back-office access to trusted networks or VPN; enforce authentication and least privilege; store uploaded files outside the web root and remove execute permissions from upload directories; monitor logs for suspicious uploads; apply vendor patch when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB