GitHub Advisoryadvisory · Packagist

GHSA-chw4-gjvw-3gxc Melis Platform CMS Unauthenticated File Upload Leading to RCE

CRITICAL Published 2025-10-08 Modified 2025-10-09 Official page ↗
Aliases
CVE-2025-10353
Ecosystem
Packagist
Packages
melisplatform/melis-cms-slider
Severity
Critical
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-43
Reviewed
2025-10-09

Affected packages

• Packagist melisplatform/melis-cms-slider: < 5.3.1 → fixed in 5.3.1

Description

File upload leading to remote code execution (RCE) in the “melis-cms-slider” module of Melis Technology's Melis Platform. This vulnerability allows an attacker to upload a malicious file via a POST request to '/melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm' using the 'mcsdetail_img' parameter.

Related

Alias · CVE (1)

  • CVE-2025-10353 File upload leading to remote code execution (RCE) in the “melis-cms-slider” module of Melis Technology's Melis Platform. vulnerability

Weakness · CWE (1)

  • CWE-43 Path Equivalence: 'filename....' (Multiple Trailing Dot) weakness

References