CVE-2025-14730 CTCMS Content Management System Backend System Configuration Ct_Config.php code injection
Remote attackers with permissions can inject code via the backend configuration module in CTCMS, leading to arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-14730?
CVE-2025-14730 is a medium-severity code injection vulnerability in CTCMS Content Management System, published on 15 Dec 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A security flaw has been discovered in CTCMS Content Management System up to 2.1.2. The impacted element is an unknown function in the library /ctcms/libs/Ct_Config.php of the component Backend System Configuration Module. The manipulation of the argument Cj_Add/Cj_Edit results in code injection. The attack can be executed remotely. The exploit has been released to the public and may be exploited.
Which versions are affected by CVE-2025-14730?
It affects 1 product.
Products include Ctcms Project Ctcms.
How do I fix CVE-2025-14730?
No fix has been published for CVE-2025-14730 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-14730 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-14730 exists.
Other vulnerabilities in CTCMS Content Management System
- CVE-2025-14731 CTCMS Content Management System Frontend/Template Management CT_Parser.php special elements used in a template engine
- CVE-2025-4545 CTCMS Content Management System File Tpl.php del path traversal
- CVE-2025-14729 CTCMS Content Management System Backend App Configuration Ct_App.php save code injection
- CVE-2024-1925 Ctcms Upsys.php unrestricted upload
Sources
Also known as GHSA-fr2p-xv84-p648.