CVE-2025-67164: Pagekit CMS is vulnerable to OS Command Injection via Storage component
An authenticated arbitrary file upload vulnerability in the /storage/poc.php component of Pagekit CMS v1.0.18 allows attackers to execute arbitrary code via uploading a crafted PHP file. The project is archived as of December 1, 2023.
Published Dec 17, 2025 · Updated Dec 18, 2025
Affected packages
pagekit/pagekit
- Ecosystem
- Composer (PHP)
- Affected
- <= 1.0.18
- Fixed in
- No patched version yet
- Check
composer show pagekit/pagekit
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
An authenticated arbitrary file upload vulnerability in the /storage/poc.php component of Pagekit CMS v1.0.18 allows attackers to execute arbitrary code via uploading a crafted PHP file.
The project is archived as of December 1, 2023.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology