CVE-2025-8265 MEDIUM

CVE-2025-8265: 299Ko CMS File Management view unrestricted upload

Vendor 299Ko
Product CMS
Weakness CWE-434 · Unrestricted file upload
Published July 28, 2025
Last update July 28, 2025
View on NVD All CVEs

CVSS base score

5.1/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability classified as critical has been found in 299Ko CMS 2.0.0. This affects an unknown part of the file /admin/filemanager/view of the component File Management. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Key dates

02Disclosure timeline

July 28, 2025 CVE published
July 28, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-49071 WordPress Flozen < 1.5.1 - Arbitrary File Upload Vulnerability CVE-2024-6161 Default Thumbnail Plus <= 1.0.2.3 - Authenticated (Contributor+) Arbitrary File Upload CVE-2023-41357 Galaxy Software Services Vitals ESP - Arbitrary File Upload CVE-2023-53950 InnovaStudio WYSIWYG Editor 5.4 Unrestricted File Upload via Filename Manipulation CVE-2025-34195 Vasion Print (formerly PrinterLogic) Unquoted Path During Driver Installation Leads to Execution of C:\Program.exe