CVE-2025-12331

MediumCVSS 4.7

Published: 27/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

31th percentile - higher than 31% of all known CVEs

Summary

A weakness was identified in Willow CMS up to 1.4.0 in an unknown function of /admin/images/add. Manipulation leads to unrestricted file upload. Remote exploitation is possible and the exploit is publicly available.

Risk Assessment

An attacker can upload malicious files and achieve code execution on the server. The public exploit increases the risk of attack.

Recommendation

Restrict file types and validate content server-side. Update Willow CMS to a version containing the fix.

Other vulnerabilities in Willow CMS

CVE-2025-12330Low
A security flaw has been discovered in Willow CMS up to 1.4.0 in the file /admin/articles/add (Add Post Page component). Manipulation of the title/body arguments results in cross site scripting. The attack may be launched remotely and the exploit has been released.

Original NVD description (English source)

A weakness has been identified in Willow CMS up to 1.4.0. Impacted is an unknown function of the file /admin/images/add. This manipulation causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS