PT-2026-22581 · Dobrycms · Dobrycms

Dawid Radziński · Published 2026-03-02 · Updated 2026-03-07 · CVE-2025-14532

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DobryCMS versions prior to 5.0

Description The software’s file upload functionality allows unauthenticated remote attackers to upload files of any type and extension without restriction. This can lead to Remote Code Execution.

Recommendations Update to version 5.0 or later.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-14532

Affected Products

Dobrycms

References · 9

• https://osv.dev/vulnerability/CVE-2025-14532 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14532 · Security Note
• https://cert.pl/posts/2026/03/CVE-2025-12462 · Note
• https://twitter.com/CVEnew/status/2028478025843581230 · Twitter Post
• https://twitter.com/cracbot/status/2029874784281194794 · Twitter Post
• https://t.me/CVEtracker/46118 · Telegram Post
• https://t.me/cveNotify/153716 · Telegram Post
• https://twitter.com/infoflowcloud/status/2028479407854129589 · Twitter Post
• https://twitter.com/cracbot/status/2030237084792082917 · Twitter Post