PT-2025-36514 · Maho · Maho

D-Xuan · Published 2025-09-08 · Updated 2025-09-09 · CVE-2025-58449

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions: Maho versions prior to 25.9.0

Description: Maho is a free and open source ecommerce platform. An authenticated staff user with access to the Dashboard and CatalogManage Products permissions can create a custom option on a listing with a file input field. By allowing file uploads with a .php extension, the user can upload malicious PHP files, gaining remote code execution.

Recommendations: Update to version 25.9.0 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-646

Related Identifiers

CVE-2025-58449

GHSA-VGMM-27FC-VMGP

Affected Products

Maho

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58449.json · Exploit
• 🔥 https://github.com/MahoCommerce/maho/security/advisories/GHSA-vgmm-27fc-vmgp · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-58449 · Security Note
• https://osv.dev/vulnerability/CVE-2025-58449 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vgmm-27fc-vmgp · Vendor Advisory
• https://github.com/MahoCommerce/maho/commit/db54a1b44e9b3fd26b27ca4d5ece0af99c4dcb53 · Note
• https://github.com/MahoCommerce/maho · Note
• https://twitter.com/CVEnew/status/1965167914849300522 · Twitter Post
• https://t.me/CVEtracker/31993 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1965187579663335460 · Twitter Post