CVE-2025-25791

MediumCVSS 4.4

Published: 26/02/2025(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

In YZNCMS v2.0.1, an arbitrary file upload vulnerability exists in the plugin installation feature. It allows an attacker to execute arbitrary code by uploading a crafted ZIP file.

Risk Assessment

The risk involves potential server compromise, leading to data theft, content modification, or further network propagation of the attack.

Recommendation

Immediately update YZNCMS to the latest version and implement file upload validation, restricting allowed extensions and scanning archives before installation.

Original NVD description (English source)

An arbitrary file upload vulnerability in the plugin installation feature of YZNCMS v2.0.1 allows attackers to execute arbitrary code via uploading a crafted Zip file.