CVE-2025-67164

Critical

Published: 17/12/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

Pagekit CMS version 1.0.18 contains an authenticated arbitrary file upload vulnerability in the /storage/poc.php component, allowing attackers to execute arbitrary code by uploading a crafted PHP file.

Risk Assessment

An authenticated attacker can execute arbitrary code on the server, potentially leading to full system compromise and data breach.

Recommendation

Upgrade Pagekit CMS to the latest version or apply security patches, and restrict user privileges.

Original NVD description (English source)

An authenticated arbitrary file upload vulnerability in the /storage/poc.php component of Pagekit CMS v1.0.18 allows attackers to execute arbitrary code via uploading a crafted PHP file.