Remote Code Execution Vulnerability in PAD CMS Photo Upload Functionality
CVE-2025-7065

10CRITICAL

Key Information:

Vendor

Polska Akademia Dostępności

Status
Pad Cms
Vendor
CVE Published:
30 September 2025

What is CVE-2025-7065?

The PAD CMS has a significant flaw in its photo upload functionality, where due to an improperly controlled permission check parameter, an unauthenticated remote attacker can upload any type of file. This oversight permits potential exploitation, allowing attackers to execute malicious code on the server. Importantly, this vulnerability impacts all three templates utilized by PAD CMS, namely www, bip, and ww+bip. Furthermore, with the product being End-Of-Life, it is unlikely that patches will be provided to remediate these security issues.

Affected Version(s)

PAD CMS 0 <= 1.2.1

References

https://cert.pl/posts/2025/09/CVE-2025-7063

CVSS V4

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kamil Szczurowski
Robert Kruczek
JSON
.