CVE-2022-25578

CriticalCVSS 9.8

Published: 18/03/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.67%

74th percentile - higher than 74% of all known CVEs

Summary

A vulnerability in taocms v3.0.2 allows attackers to inject code by arbitrarily editing the .htaccess file. Attackers can modify this file to execute malicious commands on the server.

Risk Assessment

The risk for the organization includes full server compromise, which can lead to data theft, website defacement, or using the server for further attacks.

Recommendation

It is recommended to immediately update taocms to the latest version and restrict permissions to edit the .htaccess file only to trusted administrators.

Original NVD description (English source)

taocms v3.0.2 allows attackers to execute code injection via arbitrarily editing the .htaccess file.