Critical · 9.8 CVE-2025-65602 EUVD-2025-202628GHSA-374c-2pvv-fxf5

A template injection vulnerability in the /vip/v1/file/save component of ChanCMS v3.3.4 allows attackers to execute arbitrary code via a cr…

Published Dec 10, 2025 · Updated Dec 18, 2025 · Assigned by mitre

Description

A template injection vulnerability in the /vip/v1/file/save component of ChanCMS v3.3.4 allows attackers to execute arbitrary code via a crafted POST request.

References

https://gitee.com/chancms/ChanCMS
https://www.notion.so/ChanCMS-Unauthenticated-RCE-2a3ee9235ba380fc9973e16c06258689?source=copy_link
https://www.notion.so/ChanCMS-Unauthenticated-RCE-2a3ee9235ba380fc9973e16c06258689