CVE-2025-15540 Authenticated RCE in Raytha CMS

High 8.6 Published 16 Mar 2026 Updated 16 Mar 2026

Privileged users can execute arbitrary code via the Functions module due to lack of sandboxing, leading to remote code execution.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-15540?

CVE-2025-15540 is a high-severity code injection vulnerability in Raytha, published on 16 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

"Functions" module in Raytha CMS allows privileged users to write custom code to add functionality to application. Due to a lack of sandboxing or access restrictions, JavaScript code executed through Raytha’s “functions” feature can instantiate .NET components and perform arbitrary operations within the application’s hosting environment.

This issue was fixed in version 1.4.6.

Weakness: CWE-94

Which versions are affected by CVE-2025-15540?

It affects 1 product.

Products include Raytha Raytha.

How do I fix CVE-2025-15540?

No fix has been published for CVE-2025-15540 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2025-15540 being exploited?

There is no known exploitation of CVE-2025-15540 in the wild and no public exploit code.

Sources

Also known as GHSA-w5p6-gfqf-hh2r.