PT-2025-33480 · Unknown · Phoca Commander

Sebastian Jeż · Published 2025-08-15 · Updated 2025-08-18 · CVE-2025-54473

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:X/V:X/RE:L/U:Clear

Name of the Vulnerable Software and Affected Versions: Phoca Commander versions 1.0.0 through 4.0.0 Phoca Commander versions 5.0.0 through 5.0.1

Description: An authenticated remote code execution issue exists in Phoca Commander for Joomla. The issue allows code execution via the unzip feature.

Recommendations: Update Phoca Commander to a version newer than 4.0.0. Update Phoca Commander to a version newer than 5.0.1.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-54473

Affected Products

Phoca Commander

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-54473 · Security Note
• https://t.me/CVEtracker/30123 · Telegram Post
• https://twitter.com/autumn_good_35/status/1957455745961832639 · Twitter Post
• https://phoca.cz · Note
• https://twitter.com/VulmonFeeds/status/1956427654317412702 · Twitter Post
• https://twitter.com/CVEnew/status/1956390293164417236 · Twitter Post
• https://twitter.com/offseq/status/1956551620658913289 · Twitter Post
• https://twitter.com/CCBalert/status/1957432875097247805 · Twitter Post
• https://t.me/cveNotify/132428 · Telegram Post