CVE-2025-52921
In Innoshop through 0.4.1, an authenticated attacker could exploit the File Manager functions in the admin panel to achieve code execution on the server, by uploading a crafted file and then renaming it to have a .php extension by using the Rename Function. This bypasses the initial check that uploaded files are image files. The application relies on frontend checks to restrict the administrator from changing the extension of uploaded files to .php. This restriction is easily bypassed with any proxy tool (e.g., BurpSuite). Once the attacker renames the file, and gives it the .php extension, a GET request can be used to trigger the execution of code on the server.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.9
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
- EPSS probability
- 0.48%
- CWE
- CWE-420
- Published
- 2025-06-23
- Last modified
- 2026-03-13
Affected products
- InnoShop InnoShop
Weakness type
Related vulnerabilities
- CVE-2026-61909 — An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href...
- CVE-2026-77639 — Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many...
- CVE-2026-40435 — BIG-IP httpd access control vulnerability
- CVE-2026-43505 — An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when...
- CVE-2026-40217 — LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting...
- CVE-2026-35388 — OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.
- CVE-2026-25916 — Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not...
- CVE-2025-41727 — Beckhoff: Performing privileged operations and gaining administrator access