jackq XCMS CVE-2025-15109

Q: What is the CVSS score of CVE-2025-15109?

CVE-2025-15109 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

MEDIUM

Improper Access Control (CWE-284)

2025-12-27 cna@vuldb.com

PHP Authentication Bypass File Upload

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated remote file upload leads to arbitrary code execution via web shell.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 16:11 vuln.today

DescriptionCVE.org

A flaw has been found in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. This impacts an unknown function of the file Public/javascripts/admin/plupload-2.1.2/examples/upload.php. This manipulation causes unrestricted upload. It is possible to initiate the attack remotely. The exploit has been published and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Unrestricted file upload in jackq XCMS allows unauthenticated remote attackers to upload arbitrary files via the plupload example script, leading to arbitrary code execution. The vulnerability affects all rolling-release installations up to commit 3fab5342 and has published exploit code. No vendor patch is available, and the project has not responded to reports.

Technical ContextAI

The vulnerability resides in the file Public/javascripts/admin/plupload-2.1.2/examples/upload.php, a bundled example handler from the plupload library. The root cause is improper access control (CWE-284): the script accepts file uploads without authentication or file-type restrictions, exposing a direct upload endpoint. jackq XCMS is a PHP-based content management system maintained on Gitee, and affected deployments inherit the vendor’s rolling-release branch.

Affected ProductsAI

jackq XCMS up to commit 3fab5342cc509945a7ce1b8ec39d19f701b89261 (rolling release, no discrete version numbers). See the issue report at https://gitee.com/jackq/XCMS/issues/IDC4ZT and the VulDB advisory at https://vuldb.com/?id.338480.

RemediationAI

No vendor patch is available; the project maintainer has not released a fix. Immediately remove or block access to /Public/javascripts/admin/plupload-2.1.2/examples/upload.php (e.g., via .htaccess deny rules or web server location directives). Ensure the web server does not execute PHP in the examples subdirectory; disable script execution through Apache or nginx configuration. If the application must remain online, implement temporary code-level fixes: add authentication checks to the upload script and enforce a whitelist of allowed file extensions. Monitor the project repository (https://gitee.com/jackq/XCMS/) for an eventual patch.