CVE-2025-58449 Maho Vulnerable to Authenticated Remote Code Execution via File Upload
Authenticated staff users can upload malicious PHP files via product options, leading to remote code execution on the Maho ecommerce platform.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-58449?
CVE-2025-58449 is a high-severity vulnerability in MahoCommerce maho, published on 8 Sep 2025. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Maho is a free and open source ecommerce platform. In Maho prior to 25.9.0, an authenticated staff user with access to the `Dashboard` and `Catalog\Manage Products` permissions can create a custom option on a listing with a file input field. By allowing file uploads with a `.php` extension, the user can use the filed to upload malicious PHP files, gaining remote code execution. Version 25.9.0 fixes the issue.
Weakness: CWE-646
Which versions are affected by CVE-2025-58449?
2 open source packages ship an affected version, including mahocommerce/maho.
| Package | Affected | Fixed in |
|---|---|---|
mahocommerce/maho Packagist | All versions | 25.9.0 |
mahocommerce/maho Packagist | All versions | 25.9.0 |
How do I fix CVE-2025-58449?
Upgrade mahocommerce/maho to 25.9.0 or later.
Is CVE-2025-58449 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-58449 exists.
Sources
Also known as GHSA-vgmm-27fc-vmgp.