CVE-2025-11136 YiFang CMS Backend File.php webUploader unrestricted upload
Remote attackers with backend permissions can upload arbitrary files via the webUploader function, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-11136?
CVE-2025-11136 is a medium-severity vulnerability in YiFang CMS, published on 29 Sep 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A flaw has been found in YiFang CMS up to 2.0.2. The impacted element is the function webUploader of the file app/app/controller/File.php of the component Backend. Executing manipulation of the argument uploadpath can lead to unrestricted upload. The attack can be launched remotely. The exploit has been published and may be used.
Which versions are affected by CVE-2025-11136?
It affects 1 product.
Products include Wanglongcn Yifang.
How do I fix CVE-2025-11136?
No fix has been published for CVE-2025-11136 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-11136 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-11136 exists.
Other vulnerabilities in YiFang CMS
- CVE-2025-45887 Server-side request forgery in n/a
- CVE-2025-9398 YiFang CMS Migrate.php exportInstallTable information disclosure
- CVE-2025-9399 YiFang CMS L_tool.php sql injection
- CVE-2025-9400 YiFang CMS P_file.php mergeMultipartUpload unrestricted upload
- CVE-2025-5381 Yifang CMS Admin Panel downloadFile path traversal
Sources
Also known as GHSA-32xq-c7f5-x98h.