GitHub Advisoryadvisory · Maven

GHSA-3922-2r6r-r4fv MCMS allows arbitrary file uploads in the ueditor component

CRITICAL Published 2025-04-21 Modified 2025-04-21 Official page ↗
Aliases
CVE-2025-29287
Ecosystem
Maven
Packages
net.mingsoft:ms-mcms
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-434
Reviewed
2025-04-21

Affected packages

• Maven net.mingsoft:ms-mcms: < 5.4.4 → fixed in 5.4.4

Description

An arbitrary file upload vulnerability in the ueditor component of MCMS v5.4.3 allows attackers to execute arbitrary code via uploading a crafted file.

Related

Alias · CVE (1)

  • CVE-2025-29287 An arbitrary file upload vulnerability in the ueditor component of MCMS v5.4.3 allows attackers to execute arbitrary code via uploading a… vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References