PT-2025-17343 · Qimou Cms · Qimou Cms

Published 2025-04-18 · Updated 2025-04-21 · CVE-2025-29058

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Qimou CMS version 3.34.0

Description An issue in Qimou CMS allows a remote attacker to execute arbitrary code via the upgrade.php component.

Recommendations For Qimou CMS version 3.34.0, consider disabling the upgrade.php component until a patch is available to prevent remote code execution.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-29058

Affected Products

Qimou Cms

References · 7

• https://osv.dev/vulnerability/CVE-2025-29058 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-29058 · Security Note
• https://t.me/cvenotify/119116 · Telegram Post
• https://t.me/cvetracker/21962 · Telegram Post
• https://twitter.com/CVEnew/status/1913455462936174980 · Twitter Post
• https://cdn.wjlin0.com/halo-img/74CMSv3.34.0%E5%AD%98%E5%9C%A8%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.zip · Note
• https://t.me/cvedetector/23356 · Telegram Post