CVE-2025-60729
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
PerfreeBlog version 4.0.11 has an arbitrary file read vulnerability in the validThemeFilePath function. It allows an attacker to read arbitrary files on the server.
Risk Assessment
The risk involves potential leakage of sensitive data such as configuration files, passwords, or source code, which could lead to further attacks on the system.
Recommendation
It is recommended to immediately update PerfreeBlog to the latest version that fixes this vulnerability and restrict access to the application to trusted users only.
Other vulnerabilities in PerfreeBlog
See all- CVE-2025-60735High
PerfreeBlog version 4.0.11 has a file upload vulnerability in the installPlugin function. This allows an attacker to upload a malicious file to the server.
- CVE-2025-60731High
PerfreeBlog version 4.0.11 has a file upload vulnerability in the installTheme function. This flaw allows an attacker to upload a malicious file to the server.
- CVE-2025-60730High
PerfreeBlog version 4.0.11 has an arbitrary file deletion vulnerability in the unInstallTheme function. An attacker can exploit this flaw to delete arbitrary files on the server.
Original NVD description (English source)
PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the validThemeFilePath function