PT-2025-18069 · Ipw Systems · Ipw Systems Metazo

Patrick Hener · Published 2025-04-28 · Updated 2025-05-03 · CVE-2025-46661

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions IPW Systems Metazo versions 8.1.3 and earlier

Description The issue allows for unauthenticated Remote Code Execution because smartyValidator.php enables the attacker to provide template expressions, also known as Server-Side Template-Injection. All instances have been patched by the supplier.

Recommendations For IPW Systems Metazo version 8.1.3 and earlier, update to a patched version to resolve the issue. As a temporary workaround, consider disabling the smartyValidator.php file until a patch is available. Restrict access to the smartyValidator.php file to minimize the risk of exploitation. Avoid using template expressions in the affected API endpoints until the issue is resolved.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-1336

CWE-94

Related Identifiers

CVE-2025-46661

Affected Products

Ipw Systems Metazo

References · 15

• https://osv.dev/vulnerability/CVE-2025-46661 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-46661 · Security Note
• https://twitter.com/CveFindCom/status/1916847986941845952 · Twitter Post
• https://twitter.com/DarkWebInformer/status/1916891900851749028 · Twitter Post
• https://twitter.com/CVEnew/status/1916846420738420979 · Twitter Post
• https://twitter.com/cybercronai/status/1916886486428930124 · Twitter Post
• https://t.me/cvenotify/120029 · Telegram Post
• https://twitter.com/cracbot/status/1918621622434431041 · Twitter Post
• https://t.me/thedarkwebinformer/16546 · Telegram Post
• https://twitter.com/syedaquib77/status/1916944386837123426 · Twitter Post
• https://t.me/cvetracker/22524 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1916854463328817486 · Twitter Post
• https://code-white.com/public-vulnerability-list · Note
• https://ipwsystems.com · Note
• https://t.me/cvedetector/23910 · Telegram Post