GitHub Advisoryadvisory · Packagist

GHSA-m4f2-xpfq-h97v Pagekit CMS is vulnerable to OS Command Injection via Storage component

CRITICAL Published 2025-12-17 Modified 2025-12-18 Official page ↗
Aliases
CVE-2025-67164
Ecosystem
Packagist
Packages
pagekit/pagekit
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-434
Reviewed
2025-12-18

Affected packages

• Packagist pagekit/pagekit: <= 1.0.18 (no fix yet)

Description

An authenticated arbitrary file upload vulnerability in the /storage/poc.php component of Pagekit CMS v1.0.18 allows attackers to execute arbitrary code via uploading a crafted PHP file. The project is archived as of December 1, 2023.

Related

Alias · CVE (1)

  • CVE-2025-67164 An authenticated arbitrary file upload vulnerability in the /storage/poc.php component of Pagekit CMS v1.0.18 allows attackers to execute… vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References