CVE-2025-2978 MEDIUM

CVE-2025-2978: WCMS Article Publishing Page CKEditor unrestricted upload

Vendor N/A
Product WCMS
Weakness CWE-434 · Unrestricted file upload
Published March 31, 2025
Last update March 31, 2025
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A vulnerability was found in WCMS 11. It has been rated as critical. Affected by this issue is some unknown functionality of the file /index.php?articleadmin/upload/?&CKEditor=container&CKEditorFuncNum=1 of the component Article Publishing Page. The manipulation of the argument Upload leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Key dates

02Disclosure timeline

March 31, 2025 CVE published
March 31, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-7705 Fujian mwcms Image Upload uploadeditor.html uploadeditor unrestricted upload CVE-2026-1306 midi-Synth <= 1.1.0 - Unauthenticated Arbitrary File Upload via 'export' AJAX Action CVE-2021-24663 Simple School Staff Directory <= 1.1 - Admin+ Arbitrary File Upload CVE-2022-38140 WordPress SEO Plugin by Squirrly SEO Plugin <= 12.1.10 is vulnerable to Arbitrary File Upload CVE-2025-6873 SourceCodester Simple Company Website Users.php unrestricted upload