Vulnerabilities

TI-2025-43020 CVE-2025-70073 · GHSA-4frq-g5px-8jfp

An issue in ChestnutCMS v.1.5.8 and before allows a remote attacker to execute arbitrary…

HIGH 67

An issue in ChestnutCMS v.1.5.8 and before allows a remote attacker to execute arbitrary code via the template creation function

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00765 Published 2026-02-05 No fix listed CWE-94

TI-2025-13692 CVE-2025-15009 · GHSA-j725-9864-6gc2

liweiyi ChestnutCMS Filename upload FilenameUtils.getExtension unrestricted upload

MEDIUM 57

A flaw has been found in liweiyi ChestnutCMS up to 1.5.8.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00349 Published 2025-12-22 No fix listed CWE-284

TI-2025-11840 CVE-2025-12923 · GHSA-8fjh-p7j5-79fg

liweiyi ChestnutCMS download resourceDownload path traversal

MEDIUM 56

A vulnerability was determined in liweiyi ChestnutCMS up to 1.5.8.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00622 Published 2025-11-10 No fix listed CWE-22

TI-2025-04992 CVE-2025-5552 · GHSA-w8w4-cj3p-j5vr

ChestnutCMS API Endpoint exec deserialization

MEDIUM 57

A vulnerability was found in ChestnutCMS up to 15.1.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0052 Published 2025-06-04 No fix listed CWE-20

TI-2025-02548 CVE-2025-2917 · GHSA-cw8p-4qwh-rvpm

ChestnutCMS read readFile path traversal

MEDIUM 57

A vulnerability, which was classified as problematic, was found in ChestnutCMS up to 1.5.3.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00819 Published 2025-03-28 No fix listed CWE-22

TI-2025-01770 CVE-2025-2032 · GHSA-8f74-hp4g-75m2

ChestnutCMS rename renameFile path traversal

MEDIUM 56

A vulnerability classified as problematic was found in ChestnutCMS 1.5.2.

CVSS 4.0MEDIUM 5.1 Adjacent network Low privileges No interaction EPSS 0.0051 Published 2025-03-06 No fix listed CWE-22

TI-2025-01769 CVE-2025-2031 · GHSA-j7g6-76w3-j7qf

ChestnutCMS upload uploadFile unrestricted upload

MEDIUM 57

A vulnerability classified as critical has been found in ChestnutCMS up to 1.5.2.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0035 Published 2025-03-06 No fix listed CWE-284

TI-2024-37901 CVE-2024-57452 · GHSA-3gxq-m6pm-q3fj

ChestnutCMS <=1.5.0 has an arbitrary file deletion vulnerability in…

HIGH 72

ChestnutCMS <=1.5.0 has an arbitrary file deletion vulnerability in contentcore.controller.FileController, which allows attackers to delete any file and folder.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00389 Published 2025-02-03 No fix listed CWE-552

TI-2024-37900 CVE-2024-57451 · GHSA-wgvg-989w-h74r

ChestnutCMS <=1.5.0 has a directory traversal vulnerability in…

HIGH 72

ChestnutCMS <=1.5.0 has a directory traversal vulnerability in contentcore.controller.FileController#getFileList, which allows attackers to view any directory.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00866 Published 2025-02-03 No fix listed CWE-22

TI-2024-37899 CVE-2024-57450 · GHSA-73mq-397v-4rm9

ChestnutCMS <=1.5.0 is vulnerable to File Upload via the Create template function.

HIGH 82

ChestnutCMS <=1.5.0 is vulnerable to File Upload via the Create template function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00561 Published 2025-02-03 No fix listed CWE-434

TI-2024-37682 CVE-2024-56828 · GHSA-2423-2c9w-8vgr

File Upload vulnerability in ChestnutCMS through 1.5.0.

HIGH 82

File Upload vulnerability in ChestnutCMS through 1.5.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00908 Published 2025-01-06 No fix listed CWE-434

Vulnerabilities

Filters