{"id":"CVE-2025-15540","state":"PUBLISHED","title":"Authenticated RCE in Raytha CMS","description":"\"Functions\" module in Raytha CMS allows privileged users to write custom code to add functionality to application. Due to a lack of sandboxing or access restrictions, JavaScript code executed through Raytha’s “functions” feature can instantiate .NET components and perform arbitrary operations within the application’s hosting environment.\n\nThis issue was fixed in version 1.4.6.","publishedAt":"2026-03-16T11:52:33.319Z","updatedAt":"2026-03-16T14:20:16.168Z","severity":{"score":8.6,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","source":"CERT-PL"},"assigner":"CERT-PL","products":["Raytha Raytha"],"affected":[{"vendor":"Raytha","product":"Raytha","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.4.6","versionType":"semver"}],"modules":["Functions"],"repo":"https://github.com/raythahq/raytha"}],"references":["https://cert.pl/en/posts/2026/03/CVE-2025-69236","https://raytha.com"],"weaknesses":["CWE-94"],"ingestedAt":"2026-10-29T20:08:31.050Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/15xxx/CVE-2025-15540.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-15540","state":"PUBLISHED","datePublished":"2026-03-16T11:52:33.319Z","dateUpdated":"2026-03-16T14:20:16.168Z","assignerShortName":"CERT-PL","assignerOrgId":"4bb8329e-dd38-46c1-aafb-9bf32bcb93c6","dateReserved":"2026-01-19T12:32:08.960Z"},"containers":{"cna":{"title":"Authenticated RCE in Raytha CMS","descriptions":[{"lang":"en","value":"\"Functions\" module in Raytha CMS allows privileged users to write custom code to add functionality to application. Due to a lack of sandboxing or access restrictions, JavaScript code executed through Raytha’s “functions” feature can instantiate .NET components and perform arbitrary operations within the application’s hosting environment.\n\nThis issue was fixed in version 1.4.6."}],"affected":[{"vendor":"Raytha","product":"Raytha","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.4.6","versionType":"semver"}],"modules":["Functions"],"repo":"https://github.com/raythahq/raytha"}],"references":[{"url":"https://cert.pl/en/posts/2026/03/CVE-2025-69236","tags":["third-party-advisory"]},{"url":"https://raytha.com","tags":["product"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.6,"baseSeverity":"HIGH","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-94","description":"CWE-94 Improper Control of Generation of Code ('Code Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"CERT-PL","orgId":"4bb8329e-dd38-46c1-aafb-9bf32bcb93c6","dateUpdated":"2026-03-16T11:52:33.319Z"},"credits":[{"lang":"en","type":"finder","value":"Daniel Basta"}],"impacts":[{"capecId":"CAPEC-242","descriptions":[{"lang":"en","value":"CAPEC-242 Code Injection"}]}],"source":{"discovery":"EXTERNAL"},"tags":["x_open-source"],"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2025-15540","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-03-16T14:07:32.977179Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-03-16T14:20:16.168Z"}}]}}}