GitHub Advisoryadvisory · Packagist

GHSA-mcxq-54f4-mmx5 FeehiCMS Has a Remote Code Execution via Unrestricted File Upload in Ad Management

MEDIUM Published 2025-12-02 Modified 2025-12-03 Official page ↗
Aliases
CVE-2025-65657
Ecosystem
Packagist
Packages
feehi/cms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-20, CWE-77
Reviewed
2025-12-03

Affected packages

• Packagist feehi/cms: <= 2.1.1 (no fix yet)

Description

FeehiCMS version 2.1.1 has a Remote Code Execution via Unrestricted File Upload in Ad Management. FeehiCMS version 2.1.1 allows authenticated remote attackers to upload files that the server later executes (or stores in an executable location) without sufficient validation, sanitization, or execution restrictions. An authenticated remote attacker can upload a crafted PHP file and cause the application or web server to execute it, resulting in remote code execution (RCE).

Related

Alias · CVE (1)

  • CVE-2025-65657 FeehiCMS version 2.1.1 has a Remote Code Execution via Unrestricted File Upload in Ad Management. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References