CVE-2025-70364

HighCVSS 8.8

Published: 09/04/2026(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

22th percentile - higher than 22% of all known CVEs

Summary

In Kiamo before version 8.4, an authenticated attacker with administrator privileges can execute arbitrary PHP code on the server. The vendor claims this is an intended administrative feature, but restrictions on some PHP functions were added in version 8.4.

Risk Assessment

The risk involves potential full server compromise by an administrator, which could lead to data theft, system modification, or further attacks within the network.

Recommendation

Immediately upgrade Kiamo to version 8.4 or later and restrict administrative access to trusted users only.

Other vulnerabilities in Kiamo

CVE-2025-70365Medium
A stored cross-site scripting (XSS) vulnerability exists in Kiamo before version 8.4 due to improper output encoding of user-supplied input in administrative interfaces. An authenticated administrative user can inject arbitrary JavaScript code that is executed in the browser of users viewing the affected pages.

Original NVD description (English source)

An issue was discovered in Kiamo before 8.4 allowing authenticated administrative attackers to execute arbitrary PHP code on the server. NOTE: the Supplier's position is that this is "a historical and intended administrative feature of the product, accessible only to already authenticated users explicitly granted administrator privileges." However, restrictions on some PHP functions were added in 8.4.