PT-2025-40951 · Kuno Cms · Kuno Cms

Xuemian168 · Published 2025-10-06 · Updated 2025-10-07 · CVE-2025-61768

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:L/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions KUNO CMS versions prior to 1.3.15

Description KUNO CMS is a full-stack blog application. A Server-Side Request Forgery (SSRF) issue exists in the Media module of the administrative panel. An administrator can upload a specially crafted SVG file with an external image reference, causing the server to connect to an arbitrary external URL. This could lead to information disclosure or internal network probing. SSRF is a web security issue that allows an attacker to cause the server to make HTTP requests to an arbitrary domain of the attacker's choosing.

Recommendations Update to KUNO CMS version 1.3.15 or later.

Exploit

Fix

SSRF

Unrestricted File Upload

RCE

Weakness Enumeration

CWE-918

CWE-434

CWE-20

Related Identifiers

CVE-2025-61768

GHSA-4F5F-2C49-5MWM

Affected Products

Kuno Cms

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61768.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-61768 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61768 · Security Note
• https://github.com/xuemian168/kuno/releases/tag/v1.3.15 · Note
• https://github.com/xuemian168/kuno/commit/804b2909c65b16ae2063d0f992e0711aa09475e2 · Note
• https://github.com/xuemian168/kuno/security/advisories/GHSA-4f5f-2c49-5mwm · Note
• https://t.me/cveNotify/137586 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1975368274842898465 · Twitter Post
• https://t.me/CVEtracker/34284 · Telegram Post
• https://twitter.com/CVEnew/status/1975323715572236769 · Twitter Post