PT-2025-40605 · Kuno Cms · Kuno Cms

Snowhy77 · Published 2025-10-03 · Updated 2025-10-04 · CVE-2025-61681

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions KUNO CMS versions prior to 1.3.14

Description KUNO CMS, a full-stack blog application, has flaws in its file upload functionality. The upload process only validates file types based on Content-Type headers and does not analyze file content or enforce extension whitelists. This allows attackers to upload SVG files containing malicious scripts, disguised as images. When users access the pages displaying these uploaded resources, arbitrary JavaScript executes in their browsers. The affected API endpoint is the file upload functionality. The vulnerable parameter is the file itself.

Recommendations Update KUNO CMS to version 1.3.14 or later.

Exploit

Fix

XSS

Unrestricted File Upload

Weakness Enumeration

CWE-79

CWE-434

Related Identifiers

CVE-2025-61681

GHSA-Q3W2-2VQP-GX3R

Affected Products

Kuno Cms

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61681.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-61681 · Security Note
• https://osv.dev/vulnerability/CVE-2025-61681 · Vendor Advisory
• https://github.com/xuemian168/kuno/security/advisories/GHSA-q3w2-2vqp-gx3r · Note
• https://github.com/xuemian168/kuno/commit/fc486b5c9091b607f82bf7b354d18f25204f7dc6 · Note
• https://github.com/xuemian168/kuno/releases/tag/v1.3.14 · Note
• https://t.me/CVEtracker/34068 · Telegram Post
• https://t.me/cveNotify/137378 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1974318446297923655 · Twitter Post
• https://twitter.com/CVEnew/status/1974236533688308114 · Twitter Post