CVE-2025-65473
CriticalSummary
An arbitrary file rename vulnerability in the /admin/filer.php component of EasyImages 2.0 v2.8.6 and below allows attackers with Administrator privileges to execute arbitrary code via injecting a crafted payload into an uploaded file name.
Risk Assessment
Risk of arbitrary code execution on the server by an administrator, potentially leading to full system compromise and data integrity breach.
Recommendation
Update EasyImages to the latest version and regularly review administrator privileges.
Other vulnerabilities in EasyImages
See all- CVE-2025-65474Critical
An arbitrary file rename vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below allows attackers to execute arbitrary code via renaming a PHP file to a SVG format.
- CVE-2023-33599Medium
EasyImages versions ≤ 2.8.1 is vulnerable to Cross Site Scripting (XSS) via viewlog.php.
Original NVD description (English source)
An arbitrary file rename vulnerability in the /admin/filer.php component of EasyImages 2.0 v2.8.6 and below allows attackers with Administrator privileges to execute arbitrary code via injecting a crafted payload into an uploaded file name.