PT-2025-42920 · Unknown · Processwire Cms

Published 2025-10-21 · Updated 2025-11-07 · CVE-2025-60790

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ProcessWire CMS version 3.0.246

Description A low-privileged user with 'lang-edit' permissions can upload a specially crafted ZIP file to the Language Support feature. This ZIP file is automatically extracted without any limitations or validation checks, potentially leading to a resource exhaustion denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

CWE-409

Related Identifiers

CVE-2025-60790

GHSA-9P44-Q66P-XM6P

Affected Products

Processwire Cms

References · 12

• 🔥 https://github.com/processwire/processwire-issues/issues/2120 · Exploit
• 🔥 https://github.com/NomanProdhan/security-vulnerability-research/tree/master/CVE-2025-60790 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-60790 · Security Note
• https://osv.dev/vulnerability/CVE-2025-60790 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9p44-q66p-xm6p · Vendor Advisory
• https://github.com/processwire/processwire · Note
• https://twitter.com/CVEnew/status/1980688635205755263 · Twitter Post
• https://t.me/cveNotify/142146 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1oe66u4/resumen_diario_de_vulnerabilidades_23102025 · Reddit Post
• https://t.me/cveNotify/140502 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1odakwu/resumen_diario_de_vulnerabilidades_22102025 · Reddit Post
• https://twitter.com/VulmonFeeds/status/1980706155644030983 · Twitter Post