CVE-2025-65474
CriticalSummary
An arbitrary file rename vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below allows attackers to execute arbitrary code via renaming a PHP file to a SVG format.
Risk Assessment
Risk of arbitrary code execution on the server, potentially leading to full system compromise and data confidentiality breach.
Recommendation
Update EasyImages to the latest version and restrict access to the admin panel to trusted users only.
Other vulnerabilities in EasyImages
See all- CVE-2025-65473Critical
An arbitrary file rename vulnerability in the /admin/filer.php component of EasyImages 2.0 v2.8.6 and below allows attackers with Administrator privileges to execute arbitrary code via injecting a crafted payload into an uploaded file name.
- CVE-2023-33599Medium
EasyImages versions ≤ 2.8.1 is vulnerable to Cross Site Scripting (XSS) via viewlog.php.
Original NVD description (English source)
An arbitrary file rename vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below allows attackers to execute arbitrary code via renaming a PHP file to a SVG format.