CVE-2025-58048

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-58048", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-08-22T14:30:32.221Z", "datePublished": "2025-08-28T17:31:19.732Z", "dateUpdated": "2025-08-28T18:16:36.144Z"}, "containers": {"cna": {"title": "Paymenter Vulnerable to Remote Code Execution via Public File Uploads", "problemTypes": [{"descriptions": [{"cweId": "CWE-434", "lang": "en", "description": "CWE-434: Unrestricted Upload of File with Dangerous Type", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/Paymenter/Paymenter/security/advisories/GHSA-5pm9-r2m8-rcmj", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Paymenter/Paymenter/security/advisories/GHSA-5pm9-r2m8-rcmj"}, {"name": "https://github.com/Paymenter/Paymenter/commit/87c3db42282ada1e3cda54b9a01f846926c0669b", "tags": ["x_refsource_MISC"], "url": "https://github.com/Paymenter/Paymenter/commit/87c3db42282ada1e3cda54b9a01f846926c0669b"}, {"name": "https://github.com/Paymenter/Paymenter/releases/tag/v1.2.11", "tags": ["x_refsource_MISC"], "url": "https://github.com/Paymenter/Paymenter/releases/tag/v1.2.11"}], "affected": [{"vendor": "Paymenter", "product": "Paymenter", "versions": [{"version": "< 1.2.11", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-08-28T17:31:19.732Z"}, "descriptions": [{"lang": "en", "value": "Paymenter is a free and open-source webshop solution for hostings. Prior to version 1.2.11, the ticket attachments functionality in Paymenter allows a malicious authenticated user to upload arbitrary files. This could result in sensitive data extraction from the database, credentials being read from configuration files, and arbitrary system commands being run under the web server user context. This vulnerability was patched by commit 87c3db4 and was released under the version 1.2.11 tag without any other code modifications compared to version 1.2.10. If upgrading is not immediately possible, administrators can mitigate this vulnerability with one or more of the following measures: updating nginx config to download attachments instead of executing them or disallowing access to /storage/ fully using a WAF such as Cloudflare."}], "source": {"advisory": "GHSA-5pm9-r2m8-rcmj", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-28T18:16:29.223115Z", "id": "CVE-2025-58048", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-28T18:16:36.144Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-58048", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-08-28T18:16:29.223115Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-28T18:16:33.705Z"}}], "cna": {"title": "Paymenter Vulnerable to Remote Code Execution via Public File Uploads", "source": {"advisory": "GHSA-5pm9-r2m8-rcmj", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Paymenter", "product": "Paymenter", "versions": [{"status": "affected", "version": "< 1.2.11"}]}], "references": [{"url": "https://github.com/Paymenter/Paymenter/security/advisories/GHSA-5pm9-r2m8-rcmj", "name": "https://github.com/Paymenter/Paymenter/security/advisories/GHSA-5pm9-r2m8-rcmj", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Paymenter/Paymenter/commit/87c3db42282ada1e3cda54b9a01f846926c0669b", "name": "https://github.com/Paymenter/Paymenter/commit/87c3db42282ada1e3cda54b9a01f846926c0669b", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Paymenter/Paymenter/releases/tag/v1.2.11", "name": "https://github.com/Paymenter/Paymenter/releases/tag/v1.2.11", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Paymenter is a free and open-source webshop solution for hostings. Prior to version 1.2.11, the ticket attachments functionality in Paymenter allows a malicious authenticated user to upload arbitrary files. This could result in sensitive data extraction from the database, credentials being read from configuration files, and arbitrary system commands being run under the web server user context. This vulnerability was patched by commit 87c3db4 and was released under the version 1.2.11 tag without any other code modifications compared to version 1.2.10. If upgrading is not immediately possible, administrators can mitigate this vulnerability with one or more of the following measures: updating nginx config to download attachments instead of executing them or disallowing access to /storage/ fully using a WAF such as Cloudflare."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434: Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-08-28T17:31:19.732Z"}}}, "cveMetadata": {"cveId": "CVE-2025-58048", "state": "PUBLISHED", "dateUpdated": "2025-08-28T18:16:36.144Z", "dateReserved": "2025-08-22T14:30:32.221Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-08-28T17:31:19.732Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "Paymenter", "vendor": "Paymenter", "versions": [{"status": "affected", "version": "< 1.2.11"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Paymenter is a free and open-source webshop solution for hostings. Prior to version 1.2.11, the ticket attachments functionality in Paymenter allows a malicious authenticated user to upload arbitrary files. This could result in sensitive data extraction from the database, credentials being read from configuration files, and arbitrary system commands being run under the web server user context. This vulnerability was patched by commit 87c3db4 and was released under the version 1.2.11 tag without any other code modifications compared to version 1.2.10. If upgrading is not immediately possible, administrators can mitigate this vulnerability with one or more of the following measures: updating nginx config to download attachments instead of executing them or disallowing access to /storage/ fully using a WAF such as Cloudflare."}, {"lang": "es", "value": "Paymenter es una soluci\u00f3n de tienda web de c\u00f3digo abierto y gratuita para alojamientos. Antes de la versi\u00f3n 1.2.11, la funcionalidad de adjuntos de tickets en Paymenter permite a un usuario autenticado malicioso cargar archivos arbitrarios. Esto podr\u00eda resultar en la extracci\u00f3n de datos sensibles de la base de datos, la lectura de credenciales de archivos de configuraci\u00f3n y la ejecuci\u00f3n de comandos de sistema arbitrarios bajo el contexto de usuario del servidor web. Esta vulnerabilidad fue parcheada por el commit 87c3db4 y fue lanzada bajo la etiqueta de la versi\u00f3n 1.2.11 sin ninguna otra modificaci\u00f3n de c\u00f3digo en comparaci\u00f3n con la versi\u00f3n 1.2.10. Si la actualizaci\u00f3n no es posible de inmediato, los administradores pueden mitigar esta vulnerabilidad con una o m\u00e1s de las siguientes medidas: actualizar la configuraci\u00f3n de nginx para descargar los adjuntos en lugar de ejecutarlos o denegar completamente el acceso a /storage/ utilizando un WAF como Cloudflare."}], "id": "CVE-2025-58048", "lastModified": "2026-09-26T00:10:00.127", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-58048", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-08-28T18:16:29.223115Z", "version": "2.0.3"}}]}, "published": "2025-08-28T18:15:33.473", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/Paymenter/Paymenter/commit/87c3db42282ada1e3cda54b9a01f846926c0669b"}, {"source": "security-advisories@github.com", "url": "https://github.com/Paymenter/Paymenter/releases/tag/v1.2.11"}, {"source": "security-advisories@github.com", "url": "https://github.com/Paymenter/Paymenter/security/advisories/GHSA-5pm9-r2m8-rcmj"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{}