CVE-2025-5499: slackero phpwcms image_resized.php getimagesize deserialization
A vulnerability classified as critical has been found in slackero phpwcms up to 1.9.45/1.10.8. Affected is the function isfile/getimagesize of the file imageresized.php. The manipulation of the argument imgfile leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.9.46 and 1.10.9 is able to address this issue. It is recommended to upgrade the affected component.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-5499?
CVE-2025-5499 is classified as a critical vulnerability.
What software versions are affected by CVE-2025-5499?
CVE-2025-5499 affects slackero phpwcms versions up to 1.9.45 and 1.10.8.
How do I fix CVE-2025-5499?
To fix CVE-2025-5499, upgrade to a version of slackero phpwcms that is not affected, specifically a version later than 1.9.45 or 1.10.8.
What type of vulnerability is CVE-2025-5499?
CVE-2025-5499 is a deserialization vulnerability that allows for remote exploitation.
Which function is associated with CVE-2025-5499?
CVE-2025-5499 is associated with the functions is_file and getimagesize in the file image_resized.php.