What is the CVSS score of CVE-2025-56704?

CVE-2025-56704 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of LeptonCMS are affected by CVE-2025-56704?

LeptonCMS 7.3.0 contains a critical file-upload vulnerability allowing authenticated users to execute arbitrary server code through ZIP or PHP file uploads that bypass validation.

Is there a public PoC exploit available for CVE-2025-56704?

Yes, a public proof-of-concept exploit is available for CVE-2025-56704. Prioritise patching immediately. EPSS: 0.7%.

How to fix or mitigate CVE-2025-56704?

Within 24 hours: Identify all LeptonCMS 7.3.0 instances and audit user accounts with file-upload permissions. Within 7 days: Implement application-level upload restrictions (disable ZIP uploads, enforce strict file-type validation), deploy WAF rules blocking suspicious uploads, and restrict application directory permissions. Within 30 days: Monitor vendor security advisories for patch availability or plan controlled migration away from LeptonCMS 7.3.0.

LeptonCMS CVE-2025-56704

HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2025-12-09 cve@mitre.org

PHP RCE File Upload Leptoncms

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable upload endpoint (AV:N, AC:L) requires an authenticated low-privilege account (PR:L), no user interaction, and yields full webshell RCE compromising C/I/A within the same host scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 03:16 vuln.today

DescriptionNVD

LeptonCMS version 7.3.0 contains an arbitrary file upload vulnerability, which is caused by the lack of proper validation for uploaded files. An authenticated attacker can exploit this vulnerability by uploading a specially crafted ZIP/PHP file to execute arbitrary code.

AnalysisAI

Arbitrary code execution in LeptonCMS 7.3.0 lets an authenticated attacker upload a crafted ZIP or PHP file that bypasses the application's missing file-type validation and runs as server-side PHP. Publicly available exploit code (three PoC write-ups) exists, though the flaw is not listed in CISA KEV and EPSS is low (0.66%, 47th percentile), indicating no evidence of widespread active exploitation yet. Exploitation requires a valid low-privilege account (PR:L), placing this in the post-authentication RCE category.

Technical ContextAI

LeptonCMS is a PHP-based content management system; the affected build is pinpointed by CPE cpe:2.3:a:lepton-cms:leptoncms:7.3.0. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): the upload handler does not enforce an allow-list on file extension or content, so a PHP script - or a PHP payload packed inside a ZIP archive that the application extracts into a web-accessible directory - is stored where the PHP interpreter will execute it. Because CMS upload/media and add-on/module import features routinely accept ZIP archives, the ability to smuggle executable PHP through the archive path is the pivotal weakness that turns an ordinary file upload into remote code execution.

RemediationAI

No vendor-released patch or fixed version is identified in the available data, so no exact upgrade target can be cited. As specific compensating controls: restrict who holds LeptonCMS accounts and disable self-registration so the required PR:L foothold cannot be obtained by anonymous users; remove or restrict access to the media/add-on upload and ZIP-import features for all but trusted administrators (trade-off: blocks legitimate module and media management); enforce an extension and MIME allow-list at a reverse proxy or WAF and reject .php/.phtml/.php5 and archive contents (trade-off: may block legitimate archive uploads); and configure the web server to deny PHP execution in upload/media directories via server config, e.g. disabling the PHP handler for those paths (trade-off: breaks any feature that legitimately serves generated PHP from those directories). Consult the vendor (LeptonCMS project) for an official fix before restoring full upload functionality. The only external references currently available are the PoC documents at https://github.com/Kayi626/Vulns.