LeptonCMS CVE-2025-56704

Exploitation requires a valid authenticated LeptonCMS account (CVSS PR:L) with access to a file-upload feature that accepts ZIP or PHP files; the specific prerequisite named in the description is the ability to upload a specially crafted ZIP/PHP file into LeptonCMS 7.3.0's upload handler, which lacks proper file-type validation, plus a deployment where the uploaded file lands in a web-accessible, PHP-executing directory. Limiting factors: the attacker must already be authenticated (no anonymous exploitation), the target must be running the specific 7.3.0 version, and the upload destination must permit PHP execution - hardened deployments that disable PHP in upload directories or block dangerous extensions at a proxy substantially reduce exploitability. No user interaction by a victim is required (UI:N).

The CVSS 3.1 score is 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting network reach, low complexity, only low privileges required, no user interaction, and full compromise of confidentiality, integrity and availability of the host application. The signals partly diverge: publicly available exploit code raises practical exploitability, but the EPSS probability is low (0.66%, 47th percentile) and the CVE is not in CISA KEV, so there is no confirmation of real-world exploitation - consistent with a newly disclosed post-auth RCE that is easy to weaponize but gated behind authentication. The key limiting factor is PR:L: an attacker must first obtain a valid account, which tempers the AV:N/AC:L profile. Net assessment: a genuine high priority for any internet-exposed LeptonCMS 7.3.0 with untrusted or self-registered users, but lower urgency where CMS accounts are tightly controlled.

An attacker who has registered or been granted a low-privilege LeptonCMS 7.3.0 account logs in and uses an upload feature to submit a ZIP archive containing a PHP webshell (or a direct .php file), which the application stores in a web-reachable path without validating its type. The attacker then requests that file's URL, executing the payload and gaining code execution on the server. Publicly available proof-of-concept documentation demonstrates the technique, and the low attack complexity (AC:L, UI:N) makes it straightforward to reproduce.