Critical · 9.8 CVE-2025-25784 EUVD-2025-5360GHSA-xg6j-fjj2-gv89

An arbitrary file upload vulnerability in the component \c\TemplateController.php of Jizhicms v2.5.4 allows attackers to execute arbitrary …

Published Feb 26, 2025 · Updated Jul 5, 2026 · Assigned by mitre

Description

An arbitrary file upload vulnerability in the component \c\TemplateController.php of Jizhicms v2.5.4 allows attackers to execute arbitrary code via uploading a crafted Zip file.

References

https://www.jizhicms.cn/
https://github.com/Ka7arotto/JizhiCms/blob/main/jizhicms.md