Arbitrary File Upload Vulnerability in MCMS Version 6.0.1 by MingSoft
CVE-2025-60838

6.5MEDIUM

Key Information:

Vendor

MingSoft

Status
MCMS
Vendor
CVE Published:
10 October 2025

What is CVE-2025-60838?

An identified vulnerability in MCMS version 6.0.1 allows attackers to upload specially crafted files. This vulnerability enables the execution of arbitrary code on the server, posing a significant threat to system integrity and security. Organizations using this version should take immediate precautions to mitigate potential risks, such as implementing proper file validation and access controls. For further details, visit the MingSoft website or the Gitee repository.

References

https://gitee.com/mingSoft/MCMS
https://gist.github.com/xuzhiwei66666666/8a990104861ce31c...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.