A flaw has been found in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function FilenameUtils.getExtension of the file /dev-api/common/upload of the component Filename Handler. Executing manipulation of the argument File can lead to unrestricted upload. The attack may be launched remotely. The exploit has been published and may be used.
References
| Link | Resource |
|---|---|
| https://github.com/yuccun/CVE/blob/main/ChestnutCMS-Arbitrary_File_Upload.md | Exploit Third Party Advisory |
| https://github.com/yuccun/CVE/blob/main/ChestnutCMS-Arbitrary_File_Upload.md#vulnerability-proof | Exploit Third Party Advisory |
| https://vuldb.com/?ctiid.337715 | Permissions Required VDB Entry |
| https://vuldb.com/?id.337715 | Third Party Advisory VDB Entry |
| https://vuldb.com/?submit.719590 | Third Party Advisory VDB Entry |
Configurations
History
31 Dec 2025, 15:51
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/yuccun/CVE/blob/main/ChestnutCMS-Arbitrary_File_Upload.md - Exploit, Third Party Advisory | |
| References | () https://github.com/yuccun/CVE/blob/main/ChestnutCMS-Arbitrary_File_Upload.md#vulnerability-proof - Exploit, Third Party Advisory | |
| References | () https://vuldb.com/?ctiid.337715 - Permissions Required, VDB Entry | |
| References | () https://vuldb.com/?id.337715 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/?submit.719590 - Third Party Advisory, VDB Entry | |
| First Time |
1000mz
1000mz chestnutcms |
|
| CPE | cpe:2.3:a:1000mz:chestnutcms:*:*:*:*:*:*:*:* |
22 Dec 2025, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-22 03:15
Updated : 2025-12-31 15:51
NVD link : CVE-2025-15009
Mitre link : CVE-2025-15009
CVE.ORG link : CVE-2025-15009
JSON object : View
Products Affected
1000mz
- chestnutcms