CVE Catalog
CVE-2025-65602
CriticalSummary
A template injection vulnerability in the /vip/v1/file/save component of ChanCMS v3.3.4 allows attackers to execute arbitrary code via a crafted POST request.
Risk Assessment
The risk to the organization is remote code execution on the server, potentially leading to full system and data compromise.
Recommendation
It is recommended to immediately update ChanCMS to the latest version and validate/sanitize input data in the /vip/v1/file/save component.
Original NVD description (English source)
A template injection vulnerability in the /vip/v1/file/save component of ChanCMS v3.3.4 allows attackers to execute arbitrary code via a crafted POST request.