GitHub Advisoryadvisory · Packagist

GHSA-gqp9-jh35-439m Badaso CMS file upload vulnerability

HIGH Published 2025-08-26 Modified 2025-08-26 Official page ↗
Aliases
CVE-2025-52353
Ecosystem
Packagist
Packages
badaso/core
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Weaknesses
CWE-434
Reviewed
2025-08-26

Affected packages

• Packagist badaso/core: <= 2.9.11 (no fix yet)

Description

An arbitrary code execution vulnerability in Badaso CMS 2.9.11. The Media Manager allows authenticated users to upload files containing embedded PHP code via the file-upload endpoint, bypassing content-type validation. When such a file is accessed via its URL, the server executes the PHP payload, enabling an attacker to run arbitrary system commands and achieve full compromise of the underlying host. This has been demonstrated by embedding a backdoor within a PDF and renaming it with a .php extension.

Related

Alias · CVE (1)

  • CVE-2025-52353 An arbitrary code execution vulnerability in Badaso CMS 2.9.11. vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References