PT-2025-49119 · Unknown · E-Point Cms

Published 2025-12-04 · Updated 2026-03-11 · CVE-2025-65806

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions E-POINT CMS version eagle.gsam-1169.1

Description The software’s file upload feature does not properly manage nested archive files. An attacker can upload a nested ZIP archive, containing another ZIP archive with an executable file, such as a webshell.php. Extracting these archives can result in the executable being placed in a web-accessible directory, potentially leading to remote code execution (RCE), data disclosure, or account compromise. This occurs due to insufficient validation of archive contents and inadequate restrictions on where files are extracted.

Recommendations Apply updates to address the improper handling of nested archive files.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-65806

Affected Products

E-Point Cms

References · 7

• 🔥 https://github.com/Bidon47/CVE-2025-65806/blob/main/CVE-2025-65806.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-65806 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65806 · Security Note
• https://t.me/cveNotify/147755 · Telegram Post
• https://e-point.pl/produkty/e-point-cms · Note
• https://twitter.com/CVEnew/status/1996663908749529254 · Twitter Post
• https://t.me/cveNotify/155178 · Telegram Post