CVE-2025-70831
Published: 20 February 2026
Description
A Remote Code Execution (RCE) vulnerability was found in Smanga 3.2.7 in the /php/path/rescan.php interface. The application fails to properly sanitize user-supplied input in the mediaId parameter before using it in a system shell command. This allows an unauthenticated attacker…
more
to inject arbitrary operating system commands, leading to complete server compromise.
Mitigating Controls (NIST 800-53 r5)AI
SI-10 mandates validation and sanitization of user-supplied inputs such as the mediaId parameter before use in system commands, directly preventing OS command injection.
SI-2 requires timely identification, reporting, and correction of flaws like this command injection vulnerability through patching Smanga 3.2.7.
SC-7 enforces boundary protection that can inspect and block malicious mediaId inputs attempting command injection via web application firewalls.
Security SummaryAI
CVE-2025-70831 is a Remote Code Execution (RCE) vulnerability in Smanga 3.2.7, affecting the /php/path/rescan.php interface. The issue stems from the application's failure to properly sanitize user-supplied input in the mediaId parameter before incorporating it into a system shell command, enabling OS command injection as classified under CWE-78. Published on 2026-02-20, it carries a CVSS v3.1 base score of 9.8, reflecting its critical severity.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H). By supplying malicious input to the mediaId parameter, they can inject arbitrary operating system commands, achieving complete server compromise including high confidentiality, integrity, and availability impacts.
Mitigation details and additional information are available in the referenced advisory at https://github.com/LX-66-LX/cve/issues/5.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an unauthenticated RCE via OS command injection (CWE-78) in a public-facing web application endpoint, directly enabling T1190 (Exploit Public-Facing Application) and facilitating arbitrary command execution via T1059.004 (Unix Shell) in a PHP-based system shell context.