CVE-2025-52239

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-52239
An arbitrary file upload vulnerability in ZKEACMS v4.1 allows attackers to execute arbitrary code via a crafted file.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
http://shenzhen.com Broken Link
http://zkeacms.com Broken Link
https://github.com/CTRLCCT/BoolSpideer/blob/main/cve2.md Not Applicable
https://github.com/CTRLCCT/BoolSpideer/blob/main/cve2.md Not Applicable
Configurations

Configuration 1 (hide)

cpe:2.3:a:zkea:zkeacms:4.1:*:*:*:*:*:*:*
History

14 Aug 2025, 16:10

Type Values Removed Values Added
First Time Zkea
Zkea zkeacms
CPE cpe:2.3:a:zkea:zkeacms:4.1:*:*:*:*:*:*:*
References () http://shenzhen.com - () http://shenzhen.com - Broken Link
References () http://zkeacms.com - () http://zkeacms.com - Broken Link
References () https://github.com/CTRLCCT/BoolSpideer/blob/main/cve2.md - () https://github.com/CTRLCCT/BoolSpideer/blob/main/cve2.md - Not Applicable

05 Aug 2025, 14:34

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad de carga de archivos arbitrarios en ZKEACMS v4.1 permite a los atacantes ejecutar código arbitrario a través de un archivo manipulado.

04 Aug 2025, 20:15

Type Values Removed Values Added
CWE CWE-434
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
References () https://github.com/CTRLCCT/BoolSpideer/blob/main/cve2.md - () https://github.com/CTRLCCT/BoolSpideer/blob/main/cve2.md -

04 Aug 2025, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-04 19:15

Updated : 2025-08-14 16:10

NVD link : CVE-2025-52239

Mitre link : CVE-2025-52239

CVE.ORG link : CVE-2025-52239

JSON object : View

Products Affected

zkea

  • zkeacms
CWE
CWE-434

Unrestricted Upload of File with Dangerous Type