Cyber Posture

CVE-2025-2031

MediumPublic PoC

Published: 06 March 2025

Published
06 March 2025
Modified
12 May 2025
KEV Added
—
Patch
—
CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0009 25.9th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may upload tools to third-party or adversary controlled infrastructure to make it accessible during targeting.

Security Summary

CVE-2025-2031 is a critical vulnerability in ChestnutCMS versions up to 1.5.2, affecting the uploadFile function in the /dev-api/cms/file/upload endpoint. By manipulating the 'file' argument, attackers can achieve unrestricted file upload. The issue maps to CWEs-284 (Improper Access Control), CWE-434 (Unrestricted Upload of File with Dangerous Type), and CWE-79 (Cross-site Scripting). It carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and was published on 2025-03-06.

The vulnerability enables remote exploitation by low-privileged users over the network with low attack complexity and no user interaction required. Attackers can upload arbitrary files, potentially compromising confidentiality, integrity, and availability at a low impact level due to the scope remaining unchanged.

Advisories and further details are documented in references such as https://github.com/IceFoxH/VULN/issues/6 and VulDB entries (https://vuldb.com/?ctiid.298773, https://vuldb.com/?id.298773, https://vuldb.com/?submit.512029). The exploit has been publicly disclosed and may be actively used.

Details

CWE(s)
CWE-284CWE-434CWE-79

Affected Products

1000mz
chestnutcms
1.5.2

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
T1608.002 Upload Tool Resource Development
Adversaries may upload tools to third-party or adversary controlled infrastructure to make it accessible during targeting.
attack.mitre.org →
Why these techniques?

Unrestricted file upload vulnerability (CVE-2025-2031) in public-facing ChestnutCMS enables exploitation of public-facing applications (T1190), web shell deployment via uploaded malicious files (T1505.003), and staging tools (T1608.002) as noted in advisories.

References