CVE-2025-31103

Description

Untrusted data deserialization vulnerability exists in a-blog cms. Processing a specially crafted request may store arbitrary files on the server where the product is running. This can be leveraged to execute an arbitrary script on the server.

Reserved 2025-03-26 | Published 2025-03-31 | Updated 2025-03-31 | Assigner jpcert

Problem types

Deserialization of untrusted data

Product status

prior to Ver.3.1.37
affected

prior to Ver.3.0.41
affected

prior to Ver.2.11.70
affected

prior to Ver.2.10.58
affected

prior to Ver.2.9.46
affected

prior to Ver.2.8.80
affected

References

developer.a-blogcms.jp/blog/news/security-update202503.html

developer.a-blogcms.jp/blog/news/entry-4197.html

jvn.jp/en/jp/JVN66982699/

cve.org (CVE-2025-31103)

nvd.nist.gov (CVE-2025-31103)

Download JSON