CVE-2025-25789
Published: 26 February 2025
Description
FoxCMS v1.2.5 was discovered to contain a remote code execution (RCE) vulnerability via the index() method at \controller\Sitemap.php.
Security Summary
CVE-2025-25789 is a remote code execution (RCE) vulnerability (CWE-94) in FoxCMS version 1.2.5, published on 2025-02-26. The flaw exists in the index() method within the \controller\Sitemap.php component, earning a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Unauthenticated attackers with network access can exploit this vulnerability remotely with low attack complexity and no user interaction required. Successful exploitation grants high-impact control over confidentiality, integrity, and availability, enabling arbitrary code execution on the affected system.
Advisories and further details are available via references including http://foxcms.com, https://www.foxcms.cn/, and https://github.com/Ka7arotto/FoxCMS/blob/main/FoxCMS-rce3.md.
Details
- CWE(s)