CVE-2025-5499 slackero phpwcms image_resized.php getimagesize deserialization
Remote attackers can achieve code execution via unsafe deserialization in the image resizing function of phpwcms.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-5499?
CVE-2025-5499 is a medium-severity unsafe deserialization vulnerability in slackero phpwcms, published on 3 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability classified as critical has been found in slackero phpwcms up to 1.9.45/1.10.8. Affected is the function is_file/getimagesize of the file image_resized.php. The manipulation of the argument imgfile leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.9.46 and 1.10.9 is able to address this issue. It is recommended to upgrade the affected component.
Which versions are affected by CVE-2025-5499?
It affects 1 product.
Products include Phpwcms Phpwcms.
How do I fix CVE-2025-5499?
No fix has been published for CVE-2025-5499 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2025-5499 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-5499 exists.
Other vulnerabilities in slackero phpwcms
Sources
Also known as GHSA-rwr2-gc8x-639j.