critical9.8
CVE-2025-29287
MCMS allows arbitrary file uploads in the ueditor component
Impact
An arbitrary file upload vulnerability in the ueditor component of MCMS v5.4.3 allows attackers to execute arbitrary code via uploading a crafted file.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | net.mingsoft:ms-mcms | < 5.4.4 | 5.4.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mingsoft | Mcms | Version 5.4.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://gist.github.com/erdan111/38dcb5150b523436fe01249b2542f02f#file-cve-2025-29287
- https://gitee.com/mingSoft/MCMS/issues/IBOOTX
- https://github.com/advisories/GHSA-3922-2r6r-r4fv
- https://nvd.nist.gov/vuln/detail/CVE-2025-29287
- https://gitee.com/mingSoft/MCMS/commit/17679d8fae3df2b433478829b01ab05a56ffdbc8