CVE-2025-4006 MEDIUM

CVE-2025-4006: youyiio BeyongCms Document Management Page Upload.html unrestricted upload

Vendor Youyiio
Product BeyongCms
Weakness CWE-434 · Unrestricted file upload
Published April 28, 2025
Last update April 28, 2025
View on NVD All CVEs

CVSS base score

5.1/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A vulnerability classified as critical has been found in youyiio BeyongCms 1.6.0. Affected is an unknown function of the file /admin/theme/Upload.html of the component Document Management Page. The manipulation of the argument File leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Key dates

02Disclosure timeline

April 28, 2025 CVE published
April 28, 2025 Record updated