CVE-2025-15009 | THREATINT

Description

A flaw has been found in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function FilenameUtils.getExtension of the file /dev-api/common/upload of the component Filename Handler. Executing manipulation of the argument File can lead to unrestricted upload. The attack may be launched remotely. The exploit has been published and may be used.

PUBLISHED Reserved 2025-12-21 | Published 2025-12-22 | Updated 2025-12-22 | Assigner VulDB

MEDIUM: 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

MEDIUM: 6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

MEDIUM: 6.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

6.5AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR

Problem types

Unrestricted Upload

Improper Access Controls

Product status

1.5.0

affected

1.5.1

affected

1.5.2

affected

1.5.3

affected

1.5.4

affected

1.5.5

affected

1.5.6

affected

1.5.7

affected

1.5.8

affected

Timeline

2025-12-21:	Advisory disclosed
2025-12-21:	VulDB entry created
2025-12-21:	VulDB entry last update

Credits

yuccun (VulDB User) reporter

References

vuldb.com/?id.337715 (VDB-337715 | liweiyi ChestnutCMS Filename upload FilenameUtils.getExtension unrestricted upload) vdb-entry technical-description

vuldb.com/?ctiid.337715 (VDB-337715 | CTI Indicators (IOB, IOC, TTP, IOA)) signature permissions-required

vuldb.com/?submit.719590 (Submit #719590 | liweiyi ChestnutCMS <=1.5.8 Unrestricted Upload) third-party-advisory

github.com/...blob/main/ChestnutCMS-Arbitrary_File_Upload.md related

github.com/...blob/main/ChestnutCMS-Arbitrary_File_Upload.md exploit

cve.org (CVE-2025-15009)

nvd.nist.gov (CVE-2025-15009)

Download JSON