CVE-2025-15009

liweiyi ChestnutCMS Filename upload FilenameUtils.getExtension unrestricted upload

State: Published
Severity: 5.3 Medium
Published: Dec 22, 2025
Updated: Dec 22, 2025
Reserved: Dec 21, 2025

Description

A flaw has been found in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function FilenameUtils.getExtension of the file /dev-api/common/upload of the component Filename Handler. Executing manipulation of the argument File can lead to unrestricted upload. The attack may be launched remotely. The exploit has been published and may be used.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-434 Unrestricted Upload
CWE-284 Improper Access Controls

Affected Products

Product	Versions
ChestnutCMSliweiyi	1.5.0Affected 1.5.1Affected 1.5.2Affected 1.5.3Affected 1.5.4Affected 1.5.5Affected 1.5.6Affected 1.5.7Affected 1.5.8Affected

References

VDB-337715 | liweiyi ChestnutCMS Filename upload FilenameUtils.getExtension unrestricted uploadvdb-entrytechnical-description
VDB-337715 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #719590 | liweiyi ChestnutCMS <=1.5.8 Unrestricted Uploadthird-party-advisory
https://github.com/yuccun/CVE/blob/main/ChestnutCMS-Arbitrary_File_Upload.mdrelated
https://github.com/yuccun/CVE/blob/main/ChestnutCMS-Arbitrary_File_Upload.md#vulnerability-proofexploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.