{"id":"CVE-2025-11136","state":"PUBLISHED","title":"YiFang CMS Backend File.php webUploader unrestricted upload","description":"A flaw has been found in YiFang CMS up to 2.0.2. The impacted element is the function webUploader of the file app/app/controller/File.php of the component Backend. Executing manipulation of the argument uploadpath can lead to unrestricted upload. The attack can be launched remotely. The exploit has been published and may be used.","publishedAt":"2025-09-29T02:02:05.045Z","updatedAt":"2025-09-29T12:47:12.143Z","severity":{"score":5.1,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["YiFang CMS"],"affected":[{"vendor":"YiFang","product":"CMS","versions":[{"version":"2.0.0","status":"affected"},{"version":"2.0.1","status":"affected"},{"version":"2.0.2","status":"affected"}],"modules":["Backend"]}],"references":["https://vuldb.com/?id.326213","https://vuldb.com/?ctiid.326213","https://vuldb.com/?submit.657903","https://github.com/electroN1chahaha/YifangCMS-V2.0.0-Remote-Code-Execution-RCE-/issues/1"],"weaknesses":["CWE-434","CWE-284"],"ingestedAt":"2026-10-29T20:08:31.050Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/11xxx/CVE-2025-11136.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-11136","state":"PUBLISHED","datePublished":"2025-09-29T02:02:05.045Z","dateUpdated":"2025-09-29T12:47:12.143Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2025-09-28T15:47:43.792Z"},"containers":{"cna":{"title":"YiFang CMS Backend File.php webUploader unrestricted upload","descriptions":[{"lang":"en","value":"A flaw has been found in YiFang CMS up to 2.0.2. The impacted element is the function webUploader of the file app/app/controller/File.php of the component Backend. Executing manipulation of the argument uploadpath can lead to unrestricted upload. The attack can be launched remotely. The exploit has been published and may be used."},{"lang":"de","value":"Es wurde eine Schwachstelle in YiFang CMS up to 2.0.2 entdeckt. Betroffen davon ist die Funktion webUploader der Datei app/app/controller/File.php der Komponente Backend. Die Bearbeitung des Arguments uploadpath verursacht unrestricted upload. Umgesetzt werden kann der Angriff über das Netzwerk. Der Exploit ist öffentlich verfügbar und könnte genutzt werden."}],"affected":[{"vendor":"YiFang","product":"CMS","versions":[{"version":"2.0.0","status":"affected"},{"version":"2.0.1","status":"affected"},{"version":"2.0.2","status":"affected"}],"modules":["Backend"]}],"references":[{"url":"https://vuldb.com/?id.326213","name":"VDB-326213 | YiFang CMS Backend File.php webUploader unrestricted upload","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.326213","name":"VDB-326213 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.657903","name":"Submit #657903 | YiFang YiFang CMS V2.0.0 Arbitrary File Upload","tags":["third-party-advisory"]},{"url":"https://github.com/electroN1chahaha/YifangCMS-V2.0.0-Remote-Code-Execution-RCE-/issues/1","tags":["exploit","issue-tracking"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.1,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":4.7,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":4.7,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":5.8,"vectorString":"AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-434","type":"CWE","lang":"en","description":"Unrestricted Upload"}]},{"descriptions":[{"cweId":"CWE-284","type":"CWE","lang":"en","description":"Improper Access Controls"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2025-09-29T02:02:05.045Z"},"timeline":[{"time":"2025-09-28T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-09-28T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-09-28T17:52:55.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"electroN1c (VulDB User)","type":"reporter"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-09-29T12:47:03.781634Z","id":"CVE-2025-11136","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-09-29T12:47:12.143Z"}}]}}}