Is there a public PoC exploit available for CVE-2025-15009?

Yes, a public proof-of-concept exploit is available for CVE-2025-15009. Prioritise patching immediately. EPSS: 0.1%.

ChestnutCMS CVE-2025-15009

Q: What is the CVSS score of CVE-2025-15009?

CVE-2025-15009 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Improper Access Control (CWE-284)

2025-12-22 cna@vuldb.com

Authentication Bypass File Upload Chestnutcms

2.1

CVSS 4.0

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 03:00 vuln.today

DescriptionNVD

A flaw has been found in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function FilenameUtils.getExtension of the file /dev-api/common/upload of the component Filename Handler. Executing manipulation of the argument File can lead to unrestricted upload. The attack may be launched remotely. The exploit has been published and may be used.

AnalysisAI

ChestnutCMS up to version 1.5.8 allows authenticated remote attackers to upload arbitrary files by manipulating the File argument in the FilenameUtils.getExtension function of the /dev-api/common/upload endpoint. The vulnerability bypasses filename extension validation in the Filename Handler component, enabling unrestricted file uploads with low integrity and confidentiality impact. Publicly available exploit code exists; however, the low EPSS score (0.06%) and requirement for prior authentication significantly limit real-world exploitation risk compared to the CVSS base score.

Technical ContextAI

ChestnutCMS uses a filename extension validation mechanism via the FilenameUtils.getExtension function in its file upload handler component (/dev-api/common/upload). The vulnerability stems from improper input validation when processing the File argument, allowing attackers to bypass intended filename restrictions. CWE-284 (Improper Access Control) indicates the root cause is insufficient authorization or validation logic governing which file types or extensions are permitted. The attack surface is the authenticated API endpoint for file uploads, which does not properly sanitize or validate the filename extension before processing the upload.

RemediationAI

Update ChestnutCMS to a version newer than 1.5.8 that includes fixes to filename extension validation in the FilenameUtils.getExtension function - consult the vendor (1000mz) or project repository for the exact patched version, as no specific fix version is confirmed in available references. As an interim workaround, disable or restrict access to the /dev-api/common/upload endpoint via Web Application Firewall (WAF) rules or reverse proxy configuration, allowing uploads only from trusted internal systems if file upload is essential. Alternatively, implement strict file type validation at the application level by whitelisting only permitted file extensions and validating MIME types, and restrict write permissions on the upload directory to prevent execution of uploaded files. Monitor authentication logs for suspicious file uploads by users with unusual upload patterns. Note that disabling the endpoint may impact legitimate application functionality; coordinate with application owners before applying.

CVE-2025-15009 vulnerability details – vuln.today

Back