CVE-2025-65474

Critical

Published: 11/12/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

An arbitrary file rename vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below allows attackers to execute arbitrary code via renaming a PHP file to a SVG format.

Risk Assessment

Risk of arbitrary code execution on the server, potentially leading to full system compromise and data confidentiality breach.

Recommendation

Update EasyImages to the latest version and restrict access to the admin panel to trusted users only.

Original NVD description (English source)

An arbitrary file rename vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below allows attackers to execute arbitrary code via renaming a PHP file to a SVG format.