PT-2026-8017 · Unknown · Mojoportal Cms

Published 2026-02-13 · Updated 2026-02-18 · CVE-2025-69770

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MojoPortal CMS version 2.9.0.1

Description A zip slip vulnerability exists in the /DesignTools/SkinList.aspx API endpoint of the software. This allows attackers to execute arbitrary commands by uploading a specially crafted zip file. The zip file is processed without sufficient security checks, potentially leading to unintended file extraction and code execution. The vulnerable parameter is the uploaded zip file.

Recommendations Apply updates to address the zip slip vulnerability in the /DesignTools/SkinList.aspx endpoint.

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-69770

Affected Products

Mojoportal Cms

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-69770 · Security Note
• https://github.com/i7MEDIA/mojoportal/security · Note
• https://github.com/kid-tnt/Mojo-check/blob/main/Zipslip%20in%20MojoPortal%20version%202.9.0.1.md · Note
• https://twitter.com/VulmonFeeds/status/2022386819774492939 · Twitter Post
• https://twitter.com/cracbot/status/2024076486572184014 · Twitter Post
• https://twitter.com/TheHackerWire/status/2022391264667406601 · Twitter Post
• https://twitter.com/CveFindCom/status/2022418288861401225 · Twitter Post
• https://mojoportal.com/mojoportal-2-9-1 · Note