CVE-2025-52353
Badaso CMS file upload vulnerability
CVE-2025-52353 is a critical vulnerability (CVSS 9.8) in Uatech Badaso, published August 26, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.65%, the 51st percentile. No source names a fixed version.
- Severity
- 9.8 CriticalCVSS 3.1, CVE List
- Exploit chance
- 0.65%EPSS, 51st percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
An arbitrary code execution vulnerability in Badaso CMS 2.9.11. The Media Manager allows authenticated users to upload files containing embedded PHP code via the file-upload endpoint, bypassing content-type validation. When such a file is accessed via its URL, the server executes the PHP payload, enabling an attacker to run arbitrary system commands and achieve full compromise of the underlying host. This has been demonstrated by embedding a backdoor within a PDF and renaming it with a .php extension.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
badaso/corePackagist | through 2.9.11 | None known |
badaso/corePackagist | through 2.9.11, plus listed versions 1.0.01.0.0-alpha.11.0.0-alpha.101.0.0-alpha.111.0.0-alpha.12 Show 45 moreShow less1.0.0-alpha.131.0.0-alpha.141.0.0-alpha.151.0.0-alpha.161.0.0-alpha.171.0.0-alpha.181.0.0-alpha.191.0.0-alpha.21.0.0-alpha.201.0.0-alpha.211.0.0-alpha.221.0.0-alpha.231.0.0-alpha.241.0.0-alpha.251.0.0-alpha.261.0.0-alpha.271.0.0-alpha.281.0.0-alpha.291.0.0-alpha.31.0.0-alpha.301.0.0-alpha.311.0.0-alpha.321.0.0-alpha.331.0.0-alpha.341.0.0-alpha.351.0.0-alpha.361.0.0-alpha.371.0.0-alpha.381.0.0-alpha.391.0.0-alpha.41.0.0-alpha.401.0.0-alpha.51.0.0-alpha.61.0.0-alpha.71.0.0-alpha.81.0.0-alpha.91.0.0-rc1.0.0-rc.11.0.0-rc.101.0.0-rc.111.0.0-rc.121.0.0-rc.131.0.0-rc.141.0.0-rc.151.0.0-rc.2 | None known |
What each source reports
CVE List Score used
An arbitrary code execution vulnerability in Badaso CMS 2.9.11. The Media Manager allows authenticated users to upload files containing embedded PHP code via the file-upload endpoint, bypassing content-type validation. When such a file is accessed via its URL, the server executes the PHP payload, enabling an attacker to run arbitrary system commands and achieve full compromise of the underlying host. This has been demonstrated by embedding a backdoor within a PDF and renaming it with a .php extension.
- Record
CVE-2025-52353- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-434
- Updated
- 2026-11-02
EUVDEUVD-2025-25830
An arbitrary code execution vulnerability in Badaso CMS 2.9.11. The Media Manager allows authenticated users to upload files containing embedded PHP code via the file-upload endpoint, bypassing content-type validation. When such a file is accessed via its URL, the server executes the PHP payload, enabling an attacker to run arbitrary system commands and achieve full compromise of the underlying host. This has been demonstrated by embedding a backdoor within a PDF and renaming it with a .php extension.
- Record
EUVD-2025-25830- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-gqp9-jh35-439m
Badaso CMS file upload vulnerability
An arbitrary code execution vulnerability in Badaso CMS 2.9.11. The Media Manager allows authenticated users to upload files containing embedded PHP code via the file-upload endpoint, bypassing content-type validation. When such a file is accessed via its URL, the server executes the PHP payload, enabling an attacker to run arbitrary system commands and achieve full compromise of the underlying host. This has been demonstrated by embedding a backdoor within a PDF and renaming it with a .php extension.
- Record
GHSA-gqp9-jh35-439m- CVSS 4.0
- 8.9 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P - Weakness
- CWE-434
- Updated
- 2026-11-02
NVD
An arbitrary code execution vulnerability in Badaso CMS 2.9.11. The Media Manager allows authenticated users to upload files containing embedded PHP code via the file-upload endpoint, bypassing content-type validation. When such a file is accessed via its URL, the server executes the PHP payload, enabling an attacker to run arbitrary system commands and achieve full compromise of the underlying host. This has been demonstrated by embedding a backdoor within a PDF and renaming it with a .php extension.
- Record
CVE-2025-52353- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-434
- Updated
- 2026-11-02
OSV
An arbitrary code execution vulnerability in Badaso CMS 2.9.11. The Media Manager allows authenticated users to upload files containing embedded PHP code via the file-upload endpoint, bypassing content-type validation. When such a file is accessed via its URL, the server executes the PHP payload, enabling an attacker to run arbitrary system commands and achieve full compromise of the underlying host. This has been demonstrated by embedding a backdoor within a PDF and renaming it with a .php extension.
- Record
CVE-2025-52353- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-gqp9-jh35-439m
Badaso CMS file upload vulnerability
An arbitrary code execution vulnerability in Badaso CMS 2.9.11. The Media Manager allows authenticated users to upload files containing embedded PHP code via the file-upload endpoint, bypassing content-type validation. When such a file is accessed via its URL, the server executes the PHP payload, enabling an attacker to run arbitrary system commands and achieve full compromise of the underlying host. This has been demonstrated by embedding a backdoor within a PDF and renaming it with a .php extension.
- Record
GHSA-gqp9-jh35-439m- CVSS 4.0
- 8.9 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P - Weakness
- CWE-434
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
Left out here: 73 versions. The JSON record has them.