PT-2025-31058 · Yanyutao0402 · Chancms

Zast.Ai · CVE-2025-8266 · Published 2025-07-28 · Updated 2025-07-28

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions yanyutao0402 ChanCMS versions through 3.1.2

Description A critical vulnerability exists in yanyutao0402 ChanCMS. The getArticle function within the app/modules/cms/controller/collect.js file is susceptible to deserialization due to manipulation of the targetUrl argument. This issue can be exploited remotely. The exploit has been publicly disclosed.

Recommendations Upgrade to version 3.1.3 to address this issue.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

CWE-20

Related Identifiers

CVE-2025-8266

Affected Products

Chancms

References · 9

• 🔥 https://gitee.com/yanyutao0402/ChanCMS/issues/ICLP61 · Exploit
• https://osv.dev/vulnerability/CVE-2025-8266 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-8266 · Security Note
• https://gitee.com/yanyutao0402/ChanCMS/releases/tag/V3.1.3 · Patch
• https://vuldb.com/?submit.622170 · Note
• https://vuldb.com/?id.317857 · Note
• https://t.me/CVEtracker/28549 · Telegram Post
• https://vuldb.com/?ctiid.317857 · Note
• https://twitter.com/CVEnew/status/1949762896335933756 · Twitter Post