What is the CVSS score of CVE-2025-29093?

CVE-2025-29093 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Content Management System are affected by CVE-2025-29093?

A critical remote code execution vulnerability exists in Motivian CMS v41.0.0 affecting any organization using this platform for content management.

Is there a public PoC exploit available for CVE-2025-29093?

Yes, a public proof-of-concept exploit is available for CVE-2025-29093. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2025-29093?

Within 24 hours: Inventory all systems running Motivian CMS v41.0.0 and restrict network access to the Content/Gallery/Images component to authorized users only. Within 7 days: Deploy WAF rules blocking suspicious file uploads to the vulnerable endpoint and disable the image gallery feature if not business-critical. Within 30 days: Upgrade to a patched version when available or implement full network segmentation isolating affected servers; conduct forensic review for signs of exploitation.

Content Management System CVE-2025-29093

EUVD-2025-16877 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2025-06-04 cve@mitre.org

File Upload RCE Content Management System

8.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 17:29 euvd

EUVD-2025-16877

Analysis Generated

Mar 14, 2026 - 17:29 vuln.today

PoC Detected

Jun 11, 2025 - 18:53 vuln.today

Public exploit code

CVE Published

Jun 04, 2025 - 16:15 nvd

HIGH 8.2

DescriptionCVE.org

File Upload vulnerability in Motivian Content Mangment System v.41.0.0 allows a remote attacker to execute arbitrary code via the Content/Gallery/Images component.

AnalysisAI

CVE-2025-29093 is an unauthenticated file upload vulnerability in Motivian Content Management System v41.0.0 that allows remote attackers to execute arbitrary code through the Content/Gallery/Images component. The vulnerability has a CVSS score of 8.2 with high integrity impact, affecting confidentiality and code execution capabilities. No authentication is required (PR:N) and exploitation is trivial (AC:L), making this a critical threat to unpatched instances.

Technical ContextAI

This vulnerability falls under CWE-434 (Unrestricted Upload of File with Dangerous Type), a well-established weakness in file handling mechanisms. The Motivian CMS v41.0.0 Content/Gallery/Images component fails to properly validate uploaded files before processing or storing them. Attackers can likely bypass file type restrictions through techniques such as double extensions (e.g., .php.jpg), null byte injection, MIME type manipulation, or direct upload of executable scripts. The vulnerability allows arbitrary code execution, suggesting the uploaded files are either directly executable in the web root or processed by a backend handler that interprets malicious code. This is a classic post-upload execution vulnerability where insufficient validation of file content, extension, or MIME type permits executable payloads.

RemediationAI

Immediate actions: (1) Disable or restrict access to the Content/Gallery/Images upload endpoint until patched; (2) Implement web application firewall (WAF) rules to block common file upload attack patterns (.php, .phtml, .php5, etc.); (3) Verify file uploads are stored outside the web root or in a non-executable directory with proper MIME type serving (e.g., Content-Type: application/octet-stream). (4) Upgrade to the latest patched version of Motivian CMS (patch version not specified in provided data—check official Motivian releases). (5) Implement strict file upload validation: whitelist allowed extensions, validate MIME types server-side, use magic number verification, rename files with random names, and disable script execution in upload directories via web server configuration (.htaccess for Apache: php_flag engine off). (6) Conduct code audit of file upload handlers. Contact Motivian support or monitor their security advisories for official patch availability and version guidance.