PT-2026-25688 · Raytha+1 · Raytha

Daniel Basta · CVE-2025-15540 · Published 2026-03-16 · Updated 2026-03-16

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Raytha CMS versions prior to 1.4.6

Description The “Functions” module in Raytha CMS permits users with elevated privileges to introduce custom code, extending the application’s capabilities. A deficiency in sandboxing or access controls allows JavaScript code executed via this feature to instantiate .NET components and carry out arbitrary operations within the application’s hosting environment. The affected module allows for the execution of arbitrary code.

Recommendations Update to version 1.4.6 or later.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-15540

Affected Products

Raytha

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/15xxx/CVE-2025-15540.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-15540 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-15540 · Security Note
• https://github.com/raythahq/raytha · Note
• https://twitter.com/CVEnew/status/2033583660159684982 · Twitter Post
• https://cert.pl/en/posts/2026/03/CVE-2025-69236 · Note
• https://raytha.com · Note