CVE-2025-60730
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
PerfreeBlog version 4.0.11 has an arbitrary file deletion vulnerability in the unInstallTheme function. An attacker can exploit this flaw to delete arbitrary files on the server.
Risk Assessment
The risk involves the potential deletion of critical system or configuration files, which could lead to application downtime or complete data loss.
Recommendation
It is recommended to immediately update PerfreeBlog to the latest version that fixes this vulnerability. If an update is not possible, restrict access to the unInstallTheme function to trusted users only.
Other vulnerabilities in PerfreeBlog
See all- CVE-2025-60735High
PerfreeBlog version 4.0.11 has a file upload vulnerability in the installPlugin function. This allows an attacker to upload a malicious file to the server.
- CVE-2025-60731High
PerfreeBlog version 4.0.11 has a file upload vulnerability in the installTheme function. This flaw allows an attacker to upload a malicious file to the server.
- CVE-2025-60729Medium
PerfreeBlog version 4.0.11 has an arbitrary file read vulnerability in the validThemeFilePath function. It allows an attacker to read arbitrary files on the server.
Original NVD description (English source)
PerfreeBlog v4.0.11 has an arbitrary file deletion vulnerability in the unInstallTheme function