PT-2025-31002 · Chancms · Chancms

Zast.Ai · Published 2025-07-27 · Updated 2025-08-26 · CVE-2025-8228

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ChanCMS versions up to 3.1.2

Description A critical server-side request forgery (SSRF) vulnerability exists in the getPages function of the /cms/collect/getPages file. Manipulation of the targetUrl argument can lead to unauthorized access to internal server resources. The exploit has been publicly disclosed.

Recommendations Upgrade to version 3.1.3.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-8228

Affected Products

Chancms

References · 12

• 🔥 https://gitee.com/yanyutao0402/ChanCMS/issues/ICLP28 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-8228 · Security Note
• https://osv.dev/vulnerability/CVE-2025-8228 · Vendor Advisory
• https://gitee.com/yanyutao0402/ChanCMS/releases/tag/V3.1.3 · Patch
• https://twitter.com/CVEnew/status/1949407829548224698 · Twitter Post
• https://t.me/cveNotify/130588 · Telegram Post
• https://twitter.com/fernandokarl/status/1949523606607650940 · Twitter Post
• https://vuldb.com/?ctiid.317816 · Note
• https://vuldb.com/?id.317816 · Note
• https://t.me/cveNotify/133462 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1949434242917699781 · Twitter Post
• https://vuldb.com/?submit.622171 · Note