CVE-2025-5498: slackero phpwcms Custom Source Tab cnt21.readform.inc.php is_file deserialization
A vulnerability was found in slackero phpwcms up to 1.9.45/1.10.8. It has been rated as critical. This issue affects the function filegetcontents/isfile of the file include/inclib/content/cnt21.readform.inc.php of the component Custom Source Tab. The manipulation of the argument cpagecustom leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.9.46 and 1.10.9 is able to address this issue. It is recommended to upgrade the affected component.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-5498?
CVE-2025-5498 has been rated as critical due to its impact on the security of affected systems.
Which versions of software are impacted by CVE-2025-5498?
CVE-2025-5498 affects Slackero phpwcms versions up to and including 1.9.45 and 1.10.8.
How do I fix CVE-2025-5498?
To fix CVE-2025-5498, update Slackero phpwcms to a version that is not vulnerable, ideally to the latest release.
What component is affected by CVE-2025-5498?
CVE-2025-5498 affects the Custom Source Tab component, specifically in the function file_get_contents/is_file of the indicated file.
What type of vulnerability is CVE-2025-5498?
CVE-2025-5498 is a file inclusion vulnerability that can lead to unauthorized access or manipulation of files on the server.