PT-2025-19730 · Rhymix · Rhymix

Chao112122 · Published 2025-05-05 · Updated 2025-05-07 · CVE-2025-45242

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Rhymix version 2.1.22

Description The issue is related to an arbitrary file deletion vulnerability. This vulnerability can be exploited via the procFileAdminEditImage method in the /file/file.admin.controller.php file.

Recommendations For Rhymix version 2.1.22, consider disabling the procFileAdminEditImage method until a patch is available to prevent arbitrary file deletion. Restrict access to the /file/file.admin.controller.php file to minimize the risk of exploitation.

Fix

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-922

Related Identifiers

CVE-2025-45242

Affected Products

Rhymix

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-45242 · Security Note
• https://osv.dev/vulnerability/CVE-2025-45242 · Vendor Advisory
• https://github.com/rhymix/rhymix · Note
• http://rhymix.com · Note
• https://twitter.com/CVEnew/status/1919433894513766632 · Twitter Post
• https://t.me/cvedetector/24456 · Telegram Post
• https://gist.github.com/chao112122/536a55fece5f578b90cee2c841eecdce · Note
• https://t.me/cvetracker/23056 · Telegram Post
• https://twitter.com/cybercronai/status/1920115245231505459 · Twitter Post