Remote Code Execution via Unrestricted File Upload in PAD CMS
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-434.
Summary
Due to client-controlled permission check parameter, PAD CMS's upload photo functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can then be executed leading to Remote Code Execution.This issue affects all 3 templates: www, bip and ww+bip. This product is End-Of-Life and producent will not publish patches for this vulnerability.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Polska Akademia Dostępności | PAD CMS | up to 1.2.1 | — | No fix listed | CNA |
- PAD CMS VendorPolska Akademia Dostępności Affected up to 1.2.1 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:widzialni:pad_cms:*:*:*:*:*:*:*:* | up to 1.2.1 | Vulnerable | Polska Akademia Dostępności |
- cpe:2.3:a:widzialni:pad_cms:*:*:*:*:*:*:*:* Versions up to 1.2.1 Vulnerable ·Polska Akademia Dostępności
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-8120
- 2026-10-03 Alias added: GHSA-28fq-6473-mg5p
References
More Polska Akademia Dostępności Pad Cms vulnerabilities
- TI-2025-07429 Blind SQL Injection in PAD CMS CVSS 4.0HIGH 8.7
- TI-2025-07428 Blind SQL Injection in PAD CMS CVSS 4.0HIGH 8.7
- TI-2025-06427 Remote Code Execution via Unrestricted File Upload in PAD CMS CVSS 4.0CRITICAL 10.0
- TI-2025-06425 Remote Code Execution via Unrestricted File Upload in PAD CMS CVSS 4.0CRITICAL 10.0
- TI-2025-07424 Account Takeover via Reset Password Functionality in PAD CMS CVSS 4.0HIGH 8.7
- TI-2025-07425 Bruteforce Protection Bypass in PAD CMS CVSS 4.0MEDIUM 6.9
Sources
- CVE-2025-8120 · CVE Program
- CVE-2025-8120 · NVD
- FIRST EPSS
- GHSA-28fq-6473-mg5p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences