PT-2025-50636 · Unknown · Easy Images

Congsec · Published 2025-12-11 · Updated 2025-12-14 · CVE-2025-65474

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EasyImages versions 2.0 through 2.8.6

Description A flaw exists in the /admin/manager.php component that allows for arbitrary file renaming. An attacker can exploit this to execute arbitrary code by renaming a PHP file to an SVG format.

Recommendations Update EasyImages to a version later than 2.8.6.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-706

CWE-434

Related Identifiers

CVE-2025-65474

Affected Products

Easy Images

References · 5

• 🔥 https://gist.github.com/CongSec/3cf968621f71a7da35dcc9b8f0b29bb2 · Exploit
• 🔥 https://congsec.cn/?id=20251103234511-9418dk9 · Exploit
• https://osv.dev/vulnerability/CVE-2025-65474 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65474 · Security Note
• https://twitter.com/CVEnew/status/2000246188537172147 · Twitter Post