MCMS allows arbitrary file uploads in the ueditor component

published 2025-04-21 18 mo ago modified 2026-07-05 4 mo ago also GHSA-3922-2r6r-r4fv , EUVD-2025-12370

cvss: 9.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.8%; EPSS 0.8% chance of exploitation in 30 days, percentile 56%
public exploits: 0; none known

An arbitrary file upload vulnerability in the ueditor component of MCMS v5.4.3 allows attackers to execute arbitrary code via uploading a crafted file.

Patch / fix

fixed in 1 links 1

maven net.mingsoft:ms-mcms 5.4.4

gitee.com/mingSoft/MCMS@17679d8 commit

CISA SSVC

Exploitation: Proof of concept is public
Automatable: yes
Technical impact: total
Assessed: 18 mo ago (2025-04-21)

Exploit prediction

0.79% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

gitee.com https://gitee.com/mingSoft/MCMS/issues/IBOOTX referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
maven	net.mingsoft:ms-mcms	<5.4.4	5.4.4

Classification

Weakness

CWE-434 Unrestricted Upload of File with Dangerous Type

References

gitee.com /mingSoft/MCMS/commit/17679d8fae3df2b433478829b01ab05a56ffdbc8
web
gitee.com /mingSoft/MCMS/issues/IBOOTX
exploit, web, issue-tracking
gist.github.com /erdan111/38dcb5150b523436fe01249b2542f02f#file-cve-2025-29287
web, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2025-29287
advisory
github.com /ming-soft/MCMS
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary