CVE-2025-60735
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
PerfreeBlog version 4.0.11 has a file upload vulnerability in the installPlugin function. This allows an attacker to upload a malicious file to the server.
Risk Assessment
The risk involves potential remote code execution or server takeover by uploading a crafted file. This could compromise data integrity and confidentiality.
Recommendation
Immediately update PerfreeBlog to the latest version that fixes this vulnerability. If an update is not possible, restrict access to the installPlugin function to trusted users only.
Other vulnerabilities in PerfreeBlog
See all- CVE-2025-60731High
PerfreeBlog version 4.0.11 has a file upload vulnerability in the installTheme function. This flaw allows an attacker to upload a malicious file to the server.
- CVE-2025-60730High
PerfreeBlog version 4.0.11 has an arbitrary file deletion vulnerability in the unInstallTheme function. An attacker can exploit this flaw to delete arbitrary files on the server.
- CVE-2025-60729Medium
PerfreeBlog version 4.0.11 has an arbitrary file read vulnerability in the validThemeFilePath function. It allows an attacker to read arbitrary files on the server.
Original NVD description (English source)
PerfreeBlog v4.0.11 has a File Upload vulnerability in the installPlugin function