Critical · 10.0 CVE-2025-69770 EUVD-2025-206963GHSA-4gg4-26q8-wv28

A zip slip vulnerability in the /DesignTools/SkinList.aspx endpoint of MojoPortal CMS v2.9.0.1 allows attackers to execute arbitrary comman…

Published Feb 13, 2026 · Updated Feb 13, 2026 · Assigned by mitre

Description

A zip slip vulnerability in the /DesignTools/SkinList.aspx endpoint of MojoPortal CMS v2.9.0.1 allows attackers to execute arbitrary commands via uploading a crafted zip file.

References

https://github.com/kid-tnt/Mojo-check/blob/main/Zipslip%20in%20MojoPortal%20version%202.9.0.1.md
https://www.mojoportal.com/mojoportal-2-9-1
https://github.com/i7MEDIA/mojoportal/security