PT-2025-23160 · Huocms · Huocms

Yggcwhat · Published 2025-05-29 · Updated 2025-05-29 · CVE-2025-46080

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions HuoCMS version 3.5.1

Description The issue allows an attacker to exploit a flaw and bypass whitelist restrictions, enabling them to craft malicious files with specific suffixes and potentially gain control of the server.

Recommendations For HuoCMS version 3.5.1, consider restricting file upload capabilities until a patch is available, and ensure that only authorized users have access to file upload functions to minimize the risk of exploitation.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-46080

Affected Products

Huocms

References · 6

• 🔥 https://github.com/yggcwhat/CVE-2025-46080 · Exploit
• 🔥 https://github.com/yggcwhat/test2/blob/main/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-46080 · Security Note
• https://osv.dev/vulnerability/CVE-2025-46080 · Vendor Advisory
• https://t.me/cvetracker/24896 · Telegram Post
• https://twitter.com/CVEnew/status/1928087230167347443 · Twitter Post