CVE-2025-15009

HighCVSS 8.8/10Last modified Oct 19, 2026

Description

A flaw has been found in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function FilenameUtils.getExtension of the file /dev-api/common/upload of the component Filename Handler. Executing manipulation of the argument File can lead to unrestricted upload. The attack may be launched remotely. The exploit has been published and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284 CWE-434

Affected software

Vendor	Product	Versions
liweiyi	ChestnutCMS	1.5.0; 1.5.1; 1.5.2; 1.5.3; 1.5.4; 1.5.5; 1.5.6; 1.5.7; 1.5.8

References

https://github.com/yuccun/CVE/blob/main/ChestnutCMS-Arbitrary_File_Upload.mdExploit, Third Party Advisory
https://github.com/yuccun/CVE/blob/main/ChestnutCMS-Arbitrary_File_Upload.md#vulnerability-proofExploit, Third Party Advisory
https://vuldb.com/?ctiid.337715Permissions Required, VDB Entry
https://vuldb.com/?id.337715Third Party Advisory, VDB Entry
https://vuldb.com/?submit.719590Third Party Advisory, VDB Entry

Timeline

Published: Dec 22, 2025
Last modified: Oct 19, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-15014.3An access control vulnerability was discovered in the Request Trace and Download Trace functionalities of CMC before 25.1.0 due to a specifi CVE-2025-150109.8A vulnerability has been found in Tenda WH450 1.0.0.18. This issue affects some unknown processing of the file /goform/SafeUrlFilter. The ma CVE-2025-150119.8A vulnerability was found in code-projects Simple Stock System 1.0. Impacted is an unknown function of the file /logout.php. The manipulatio CVE-2025-150129.8A vulnerability was determined in code-projects Refugee Food Management System 1.0. The affected element is an unknown function of the file CVE-2025-150135.3A vulnerability was identified in floooh sokol up to 5d11344150973f15e16d3ec4ee7550a73fb995e0. The impacted element is the function _sg_vali CVE-2025-150146.3A security flaw has been discovered in loganhong php loganSite up to c035fb5c3edd0b2a5e32fd4051cbbc9e61a31426. This affects an unknown funct CVE-2025-150157.5Enterprise Cloud Database developed by Ragic has a Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit R CVE-2025-150169.8Enterprise Cloud Database developed by Ragic has a Hard-coded Cryptographic Key vulnerability, allowing unauthenticated remote attackers to CVE-2025-150177.0A vulnerability exists in serial device servers where active debug code remains enabled in the UART interface. An attacker with physical acc CVE-2025-150189.8The Optional Email plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.3 CVE-2025-150196.4The BIALTY - Bulk Image Alt Text (Alt tag, Alt Attribute) with Yoast SEO + WooCommerce plugin for WordPress is vulnerable to Stored Cross-Si CVE-2025-15025.3The IP2Location Redirection plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'down