EasyImages 2.0 CVE-2025-65474
CRITICALAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach /admin/manager.php endpoint
-
DeliveryUpload PHP payload file
-
ExploitRename to abuse SVG/PHP handling
-
ExecutionTrigger PHP execution via webshell
-
ImpactExecute arbitrary code as web server
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Incorrectly specified target
|
| Exploitation Conditions | Requires reaching the file-management/rename function in /admin/manager.php of EasyImages 2.0 (v2.8.6 or earlier) and the ability to place a PHP file and rename it so the server treats SVG-named/PHP content as executable PHP. The decisive limiting factor is access to the admin manager component: the /admin/ path implies an authenticated administrator session, which the input CVSS (PR:N) does not reflect - if the admin manager is not exposed or requires valid admin credentials, unauthenticated exploitation is not possible. There is no indication that user interaction is required, and no non-default feature toggle is named in the description beyond having the image-manager/rename capability present. |
| Impact | The input CVSS (9.8, AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) rates this as critical network-exploitable RCE, and a public POC exists (two NVD-linked exploit references on congsec.cn and a GitHub gist), which raises practical concern. However, two signals pull against treating this as an immediate mass-exploitation emergency. First, the vulnerable endpoint is /admin/manager.php - an administrative component - which strongly implies that a successful attacker must already have access to the admin panel; this conflicts with the input vector's PR:N (unauthenticated) and should be verified against the vendor/source code before trusting the unauthenticated rating. Second, EPSS is only 0.54% (44th percentile) and the CVE is NOT on CISA KEV, so there is no evidence of active or widespread exploitation despite POC availability. Net: this is a genuine code-execution bug with public exploit code, but its real-world priority is tempered by a likely authentication prerequisite and the low deployment footprint of EasyImages; it is a high priority specifically for the small population that runs internet-exposed EasyImages admin panels, not a broad fleet-wide emergency. |
| Exploit ScenarioDerived | An attacker with access to the EasyImages admin interface uploads a PHP payload and uses the file-rename function in /admin/manager.php to manipulate the file's extension/type (abusing the SVG-vs-PHP handling), causing the server to execute attacker-controlled PHP. A publicly available exploit/POC is referenced from NVD (congsec.cn and a GitHub gist), lowering the barrier to weaponization. With low attack complexity (AC:L), exploitation is reliable once the admin manager endpoint is reachable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Arbitrary file rename in the /admin/manager.php image/file manager of EasyImages 2.0 (v2.8.6 and earlier) allows an attacker to rename an uploaded PHP file to an .svg filename so the web server executes the embedded PHP, resulting in remote code execution. Public exploit code exists - two NVD-linked references (a congsec.cn write-up and a GitHub gist) - but there is no confirmed active exploitation (no CISA KEV listing), and the EPSS score is low at 0.54% (44th percentile). Our independent assessment rates the vector as PR:L rather than the published PR:N, because the vulnerable rename function lives in the /admin/ manager component and therefore normally requires a valid administrator session; unauthenticated exploitation is only realistic if that admin interface is exposed without authentication.
RemediationAI
No vendor-released patch was identified in the supplied data; the provided references are exploit write-ups and a PoC gist, not an advisory or fixed release, so the fix status should be confirmed directly with the EasyImages 2.0 project before assuming any version is safe. Until a patched build is confirmed, apply compensating controls with awareness of their trade-offs: restrict /admin/ (including /admin/manager.php) to trusted source IPs or an internal VPN and add authentication at a reverse proxy - this blocks remote exploitation but breaks legitimate remote administration; enforce strong, unique administrator credentials and MFA where the deployment supports it, since the realistic attack prerequisite is an authenticated admin session (our assessment rates this PR:L rather than the published PR:N); harden the web server so nothing in the upload/storage directories is ever executed, for example by disabling the PHP handler for those paths (Apache: php_admin_flag engine off / RemoveHandler in a directory block; nginx: a location block that returns 403 or serves only static content) - this neutralizes the .svg/PHP rename trick but may affect any legitimate dynamic behavior in that directory; and add server-side allow-list validation of the final extension on rename so only image types can be produced, with the caveat that application-level fixes are fragile until upstream patches. Monitor the EasyImages 2.0 project for a fixed release and re-scan affected instances afterwards, since the wildcard CPE cannot confirm remediation.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-706 (Use of Incorrectly-Resolved Name or Reference) and sits in the file-management/rename functionality of EasyImages 2.0's administrative manager script, /admin/manager.php. The core technology is a PHP web application that accepts uploaded image files and lets the operator rename them; because the rename operation does not adequately constrain or re-validate the resulting filename/extension mapping, an attacker can supply content that is valid PHP and then rename it so the stored name ends in .svg. The server-side handling of that name resolves differently than the application intends, so the malicious payload is served and interpreted as PHP rather than rendered as an image, producing code execution in the context of the web server user. The only CPE provided, cpe:2.3:a:easyimages2.0_project:easyimages2.0:*:*:*:*:*:*:*:*, is a wildcard with no version granularity, so it cannot distinguish patched from vulnerable releases; the description scope is 2.0 through 2.8.6. The published CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) assumes no privileges, which conflicts with the /admin/ path that our independent assessment used to derive PR:L - the practical precondition is reachability of the admin manager and the ability to place a PHP file and rename it.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Endpoint /admin/manager.php implies an authenticated admin/user session, so PR:L rather than PR:N; network-reachable rename with low complexity yields full C/I/A impact via code execution.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
An arbitrary file rename vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below allows attackers to execute arbitrary code via renaming a PHP file to a SVG format.
Executive ViewAI
EasyImages 2.0 (v2.8.6 and earlier) contains a critical file-rename flaw in its administrative file manager that can lead to remote code execution on the underlying web server. Publicly available exploit code exists, but the CVE is not listed in CISA KEV, and independent assessment points to administrator-level access being normally required. Leadership should care because affected deployments could face server compromise, data exposure, or service disruption, particularly where the admin interface is internet-facing or weakly protected.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting /admin/manager.php and the administrative interface to trusted networks or VPN, enforcing MFA and least privilege for administrators, disabling the image/file manager if not needed, blocking uploads or renames to .svg and other executable extensions via WAF or web server configuration, preventing PHP execution in upload directories, monitoring for anomalous file renames and PHP execution from .svg files, and isolating or decommissioning affected EasyImages 2.0 v2.8.6 and earlier instances until a fixed version is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)NVD
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB