PT-2025-53626 · Unknown · Jackq Xcms

Formanagain · Published 2025-12-27 · Updated 2025-12-27 · CVE-2025-15110

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions jackq XCMS versions prior to 3fab5342cc509945a7ce1b8ec39d19f701b89261

Description A flaw exists in jackq XCMS that allows for unrestricted file upload. The issue is located in the Upload function within the Admin/Home/Controller/ProductImageController.class.php file of the Backend component. Manipulation of the File argument enables remote attackers to upload files without restrictions. The exploit for this issue has been publicly disclosed and is potentially being used in active attacks. Reports indicate offensive activities targeting this vulnerability.

Recommendations Versions prior to 3fab5342cc509945a7ce1b8ec39d19f701b89261 should be updated. As a temporary workaround, consider restricting access to the ProductImageController.class.php file or disabling the Upload function until a suitable update is available.

Exploit

Fix

Improper Access Control

Unrestricted File Upload

Weakness Enumeration

CWE-284

CWE-434

Related Identifiers

CVE-2025-15110

Affected Products

Jackq Xcms

References · 12

• 🔥 https://gitee.com/jackq/XCMS/issues/IDC5C8 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-15110 · Security Note
• https://osv.dev/vulnerability/CVE-2025-15110 · Vendor Advisory
• https://vuldb.com/?ctiid.338481 · Note
• https://t.me/cveNotify/146951 · Telegram Post
• https://twitter.com/vuldb/status/2004934180216390013 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2005011967820370197 · Twitter Post
• https://vuldb.com/?id.338481 · Note
• https://gitee.com/jackq/XCMS · Note
• https://twitter.com/CVEnew/status/2005031789622866418 · Twitter Post
• https://t.me/CVEtracker/40750 · Telegram Post
• https://vuldb.com/?submit.711702 · Note