PT-2025-23733 · Unknown · Chestnutcms

Wanglun · CVE-2025-5552 · Published 2025-06-04 · Updated 2025-11-18

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ChestnutCMS versions up to 15.1

Description A critical issue has been found in the API Endpoint component, specifically affecting the /dev-api/groovy/exec file. This issue leads to deserialization and can be exploited remotely. The exploit has been publicly disclosed.

Recommendations For ChestnutCMS versions up to 15.1, as a temporary workaround, consider restricting access to the /dev-api/groovy/exec API endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Deserialization of Untrusted Data

RCE

Weakness Enumeration

CWE-502

CWE-20

Related Identifiers

CVE-2025-5552

Affected Products

Chestnutcms

References · 9

• 🔥 https://vuldb.com/?submit.587199 · Exploit
• 🔥 https://github.com/byxs0x0/cve/issues/7 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-5552 · Security Note
• https://twitter.com/VulmonFeeds/status/1930123955672674566 · Twitter Post
• https://t.me/cveNotify/143212 · Telegram Post
• https://vuldb.com/?ctiid.311002 · Note
• https://vuldb.com/?id.311002 · Note
• https://twitter.com/CVEnew/status/1930108592461369580 · Twitter Post
• https://t.me/cvetracker/25349 · Telegram Post