PT-2025-35120 · Paymenter +2 · Paymenter +2

Blackholered · Published 2025-08-28 · Updated 2025-08-29 · CVE-2025-58048

Positive Technologies · (AI Summary)

CVSS v3.1

9.9

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions:

Paymenter versions prior to 1.2.11

Description:

Paymenter is a free and open-source webshop solution for hostings. The ticket attachments functionality allows a malicious authenticated user to upload arbitrary files. This could result in sensitive data extraction from the database, credentials being read from configuration files, and arbitrary system commands being run under the web server user context.

Recommendations:

Upgrade to version 1.2.11 or later.

Update nginx configuration to download attachments instead of executing them.

Disallow access to `/storage/` using a WAF such as Cloudflare.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-58048

GHSA-5PM9-R2M8-RCMJ

Affected Products

Cloudflared

Paymenter

Nginx

References · 10

• https://osv.dev/vulnerability/CVE-2025-58048 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58048 · Security Note
• https://github.com/Paymenter/Paymenter/security/advisories/GHSA-5pm9-r2m8-rcmj · Note
• https://github.com/Paymenter/Paymenter/commit/87c3db42282ada1e3cda54b9a01f846926c0669b · Note
• https://github.com/Paymenter/Paymenter/releases/tag/v1.2.11 · Note
• https://t.me/CVEtracker/31151 · Telegram Post
• https://twitter.com/CCBalert/status/1961425841256063122 · Twitter Post
• https://twitter.com/CVEnew/status/1961123067377455542 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1961177621720449457 · Twitter Post
• https://twitter.com/CveFindCom/status/1961121554340651467 · Twitter Post