Resource-Exhaustion Vulnerability in ProcessWire CMS by ProcessWire
CVE-2025-60790

6.5MEDIUM

Key Information:

Vendor

ProcessWire

Status
ProcessWire CMS
Vendor
CVE Published:
21 October 2025

What is CVE-2025-60790?

A vulnerability in ProcessWire CMS 3.0.246 allows low-privileged users with lang-edit permissions to upload unchecked ZIP files to the Language Support feature. This ZIP file is subjected to auto-extraction without validation limits, potentially leading to resource exhaustion and Denial of Service conditions for the affected system.

References

https://github.com/processwire/processwire-issues/issues/...
https://github.com/NomanProdhan/security-vulnerability-re...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.