CVE-2025-60731
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
PerfreeBlog version 4.0.11 has a file upload vulnerability in the installTheme function. This flaw allows an attacker to upload a malicious file to the server.
Risk Assessment
The risk involves potential remote code execution or server takeover by uploading a crafted theme. This could compromise data integrity and confidentiality.
Recommendation
Immediately update PerfreeBlog to the latest version and implement file type validation in the installTheme function. Also restrict upload directory permissions.
Other vulnerabilities in PerfreeBlog
See all- CVE-2025-60735High
PerfreeBlog version 4.0.11 has a file upload vulnerability in the installPlugin function. This allows an attacker to upload a malicious file to the server.
- CVE-2025-60730High
PerfreeBlog version 4.0.11 has an arbitrary file deletion vulnerability in the unInstallTheme function. An attacker can exploit this flaw to delete arbitrary files on the server.
- CVE-2025-60729Medium
PerfreeBlog version 4.0.11 has an arbitrary file read vulnerability in the validThemeFilePath function. It allows an attacker to read arbitrary files on the server.
Original NVD description (English source)
PerfreeBlog v4.0.11 has a File Upload vulnerability in the installTheme function