CVE-2025-10993 MuYuCMS Template Management admin.php code injection

What is CVE-2025-10993?

CVE-2025-10993 is a medium-severity code injection vulnerability in MuYuCMS, published on 26 Sep 2025. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A security flaw has been discovered in MuYuCMS up to 2.7. Affected by this issue is some unknown functionality of the file /admin.php of the component Template Management. The manipulation results in code injection. It is possible to launch the attack remotely.

Weakness: CWE-94, CWE-74

Which versions are affected by CVE-2025-10993?

It affects 1 product.

Products include Muyucms Muyucms.

How do I fix CVE-2025-10993?

No fix has been published for CVE-2025-10993 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2025-10993 being exploited?

There is no known exploitation of CVE-2025-10993 in the wild and no public exploit code.

Other vulnerabilities in MuYuCMS

• CVE-2023-27701 Missing authorization in n/a High 8.1
• CVE-2023-1046 MuYuCMS getFile.html server-side request forgery Medium 6.3
• CVE-2025-15589 MuYuCMS Template Management Template.php delete_dir_file path traversal Medium 5.1
• CVE-2023-1043 MuYuCMS index.php path traversal Medium 4.3
• CVE-2023-1044 MuYuCMS index.php path traversal Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-m3c8-789m-gj36.