What is the CVSS score of CVE-2025-60838?

CVE-2025-60838 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Mingsoft MCMS CVE-2025-60838

MEDIUM

Command Injection (CWE-77)

2025-10-10 cve@mitre.org

Command Injection File Upload RCE Mcms

6.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

9.9 CRITICAL

File upload to web shell execution warrants C:H/I:H/A:H with scope change; PR:L used because CMS upload endpoints typically require at minimum contributor-level authentication, pending vendor confirmation of PR:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 04:10 vuln.today

DescriptionCVE.org

An arbitrary file upload vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary code via uploading a crafted file.

AnalysisAI

Arbitrary file upload in Mingsoft MCMS v6.0.1 enables remote code execution on the underlying server by uploading a crafted file - likely a JSP web shell - to a reachable endpoint. The NVD-assigned CVSS score of 6.5 with C:L/I:L impact subscores is materially inconsistent with the stated code execution impact, and this discrepancy should be independently verified. No public exploit has been confirmed as actively exploited per CISA KEV, though a Gist-based reference in NVD data may represent a proof-of-concept; EPSS is low at 0.28% (20th percentile), suggesting no widespread scanning or exploitation observed at time of analysis.

Technical ContextAI

MCMS (Mingsoft CMS) is a Java-based content management system developed by Mingsoft, with the affected product identified via CPE cpe:2.3:a:mingsoft:mcms:*:*:*:*:*:*:*:* (all versions, specifically v6.0.1 per the description). The root cause is classified as CWE-77 (Improper Neutralization of Special Elements Used in a Command), which - combined with the 'file upload' description and 'Command Injection' tag - indicates the uploaded file is subsequently invoked in a command or script execution context. In Java CMS deployments on Tomcat, this commonly manifests as uploading a .jsp web shell to a web-accessible directory where the servlet container executes it upon HTTP retrieval. The upload mechanism fails to enforce strict file type allowlisting or store files outside the web root, both standard defenses against this class of vulnerability.

RemediationAI

No vendor-released patched version has been independently confirmed from available data - the Gitee repository at https://gitee.com/mingSoft/MCMS should be monitored for upstream commits or tagged releases addressing this issue; any such fix version should be verified before deployment. As immediate compensating controls: restrict file upload endpoints to authenticated and authorized roles only, even if CVSS PR:N is taken at face value. Implement strict server-side file extension and MIME-type allowlisting, blocking .jsp, .jspx, .sh, .php, and similar executable types at the application layer - note that allowlisting introduces maintenance overhead when legitimate file types are added. Store all uploaded files outside the web root or in a directory served without execute permissions, which eliminates direct web shell retrieval without disrupting storage functionality. Deploy a WAF rule to block multipart uploads of executable MIME types. Enable alerting on unexpected file creation events in web-accessible directories.