CVE-2025-14729 CTCMS Content Management System Backend App Configuration Ct_App.php save code injection
Remote attackers can execute arbitrary code via the CT_App_Paytype argument in the backend app configuration module of CTCMS.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-14729?
CVE-2025-14729 is a medium-severity code injection vulnerability in CTCMS Content Management System, published on 15 Dec 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability was identified in CTCMS Content Management System up to 2.1.2. The affected element is the function Save of the file /ctcms/libs/Ct_App.php of the component Backend App Configuration Module. The manipulation of the argument CT_App_Paytype leads to code injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
Which versions are affected by CVE-2025-14729?
It affects 1 product.
Products include Ctcms Project Ctcms.
How do I fix CVE-2025-14729?
No fix has been published for CVE-2025-14729 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-14729 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-14729 exists.
Other vulnerabilities in CTCMS Content Management System
- CVE-2025-14731 CTCMS Content Management System Frontend/Template Management CT_Parser.php special elements used in a template engine
- CVE-2025-4545 CTCMS Content Management System File Tpl.php del path traversal
- CVE-2025-14730 CTCMS Content Management System Backend System Configuration Ct_Config.php code injection
- CVE-2024-1925 Ctcms Upsys.php unrestricted upload
Sources
Also known as GHSA-98vq-2fp5-cc8q.