Cadmium CMS CVE-2025-51511

Exploitation targets the administrative content filemanager upload at /admin/content/filemanager/uploads in Cadmium CMS 0.4.9; the attacker must be able to reach this backend endpoint and the server must accept and serve an executable server-side file that bypasses upload validation (CWE-434). The description's 'background' (back-office) characterization and the '/admin/' path indicate a backend/administrative feature, so a valid authenticated backend session is the most likely prerequisite - this materially limits exploitation and conflicts with the PR:N in the supplied vector, which would otherwise imply no authentication. The precise access level (unauthenticated vs. any authenticated role vs. admin only) and whether the uploaded file is placed in a web-executable path are not stated in the available sources; confirm with the vendor/source.

The input CVSS is 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which models remote, unauthenticated, trivial exploitation with full confidentiality, integrity and availability impact - consistent with CWE-434 arbitrary file upload leading to code execution. However, these signals conflict with the description and should be treated cautiously: the description calls this a 'background' file upload in /admin/content/filemanager/uploads, and the '/admin/' path plus 'background' (back-office) wording strongly implies the feature is behind the CMS administrative backend, i.e. an authenticated operation. That contradicts the PR:N in the supplied vector - the network-unauthenticated scoring may be overstated; verify whether the upload endpoint is reachable without a valid backend session. The other signals temper the raw score: EPSS is 0.38% (32nd percentile), indicating low modeled probability of exploitation in the near term; there is no CISA KEV listing in the input, so there is no evidence of active exploitation; and the only exploit artifact is an unverified reference. The vuln.today decision label is act_now, so prioritization guidance in the input is high. Netting this out: the technical impact is genuinely severe (webshell/RCE class), but the real-world urgency is tempered by an obscure product, a likely authentication prerequisite not reflected in PR:N, low EPSS, and no confirmed active exploitation.

An attacker with access to the Cadmium CMS administrative backend uses the content filemanager upload feature (/admin/content/filemanager/uploads) to upload a malicious server-side script (e.g. a PHP webshell) that is not properly validated, then requests the uploaded file to execute code on the server. A public PoC reference exists (a GitHub issue) but is not verified as working exploit code, so reliable weaponization is not confirmed. If the endpoint is in fact reachable without authentication - as the PR:N in the supplied vector suggests but the 'background'/admin wording contradicts - the same upload could be performed by a remote unauthenticated attacker.