CVE-2025-46359 Path traversal in PowerCMS

What is CVE-2025-46359?

CVE-2025-46359 is a high-severity path traversal vulnerability in Alfasado Inc. PowerCMS, published on 31 Jul 2025. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A path traversal issue exists in backup and restore feature of multiple versions of PowerCMS. A product administrator may execute arbitrary code by restoring a crafted backup file.

Weakness: CWE-22

Which versions are affected by CVE-2025-46359?

It affects 1 product.

Products include Alfasado Powercms.

How do I fix CVE-2025-46359?

No fix has been published for CVE-2025-46359 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2025-46359 being exploited?

There is no known exploitation of CVE-2025-46359 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in Alfasado Inc. PowerCMS

• CVE-2022-33941 Command injection in PowerCMS XMLRPC API Critical 9.8
• CVE-2021-20850 Command injection in PowerCMS XMLRPC API Critical 9.8
• CVE-2023-50297 Open redirect in PowerCMS (PowerCMS 4 Series) Medium 6.1
• CVE-2019-6020 Open redirect in PowerCMS Medium 6.1
• CVE-2023-49117 Cross-site scripting in PowerCMS (PowerCMS 4 Series) Medium 5.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rvp7-mgh9-qv55.