PT-2025-30728 · Chancms · Chancms

Zast.Ai · Published 2025-07-25 · Updated 2025-07-25 · CVE-2025-8132

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions yanyutao0402 ChanCMS versions up to 3.1.2

Description A path traversal issue exists in the delfile function of the app/extend/utils.js file. This issue may be exploited remotely. The exploit has been publicly disclosed.

Recommendations Upgrade to version 3.1.3 to address this issue. The patch identifier is c8a282bf02a62b59ec60b4699e91c51aff2ee9cd.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-8132

Affected Products

Chancms

References · 11

• 🔥 https://gitee.com/yanyutao0402/ChanCMS/issues/ICLOT8#note_43945209_link · Exploit
• 🔥 https://gitee.com/yanyutao0402/ChanCMS/issues/ICLOT8 · Exploit
• https://gitee.com/yanyutao0402/ChanCMS/releases/tag/V3.1.3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-8132 · Security Note
• https://osv.dev/vulnerability/CVE-2025-8132 · Vendor Advisory
• https://gitee.com/yanyutao0402/ChanCMS/commit/c8a282bf02a62b59ec60b4699e91c51aff2ee9cd · Patch
• https://twitter.com/CVEnew/status/1948615237474869300 · Twitter Post
• https://vuldb.com/?ctiid.317528 · Note
• https://twitter.com/marcin_brz81183/status/1948661210787811404 · Twitter Post
• https://vuldb.com/?submit.619776 · Note
• https://vuldb.com/?id.317528 · Note