Open-source package vulnerability · Maven
CVE-2025-29287: MCMS allows arbitrary file uploads in the ueditor component
criticalCVSS 3.1 9.8GHSA-3922-2r6r-r4fv
An arbitrary file upload vulnerability in the ueditor component of MCMS v5.4.3 allows attackers to execute arbitrary code via uploading a crafted file.
Published Apr 21, 2025
Affected packages
net.mingsoft:ms-mcms
- Ecosystem
- Maven
- Affected
- < 5.4.4
- Fixed in
- 5.4.4
- Check
mvn dependency:tree -Dincludes=net.mingsoft:ms-mcms
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
An arbitrary file upload vulnerability in the ueditor component of MCMS v5.4.3 allows attackers to execute arbitrary code via uploading a crafted file.
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-29287
- https://gist.github.com/erdan111/38dcb5150b523436fe01249b2542f02f#file-cve-2025-29287
- https://gitee.com/mingSoft/MCMS/issues/IBOOTX
- https://gitee.com/mingSoft/MCMS/commit/17679d8fae3df2b433478829b01ab05a56ffdbc8
- https://github.com/advisories/GHSA-3922-2r6r-r4fv
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology