CVE-2025-7065: Remote Code Execution via Unrestricted File Upload in PAD CMS
Due to client-controlled permission check parameter, PAD CMS's photo upload functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can then be executed leading to Remote Code Execution. This issue affects all 3 templates: www, bip and ww+bip.
This product is End-Of-Life and producent will not publish patches for this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-7065?
The severity of CVE-2025-7065 is critical due to the potential for remote code execution.
How do I fix CVE-2025-7065?
To fix CVE-2025-7065, implement strict validation and sanitization of file uploads to prevent malicious file types.
What applications are affected by CVE-2025-7065?
CVE-2025-7065 affects all versions of PAD CMS that implement the vulnerable photo upload functionality.
Can CVE-2025-7065 be exploited by unauthenticated users?
Yes, CVE-2025-7065 can be exploited by unauthenticated remote attackers.
What kind of attacks can CVE-2025-7065 lead to?
CVE-2025-7065 can lead to remote code execution attacks, allowing attackers to execute arbitrary commands on the server.