https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 23:07:44 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-252268 EUVD-2026-252268 https://cve.radiocsirt.org/vuln/euvd-2026-252268 https://cve.radiocsirt.org/vuln/fkie_cve-2025-58449 <p>Maho is a free and open source ecommerce platform. In Maho prior to 25.9.0, an authenticated staff user with access to the `Dashboard` and `Catalog\Manage Products` permissions can create a custom option on a listing with a file input field. By allowing file uploads with a `.php` extension, the user can use the filed to upload malicious PHP files, gaining remote code execution. Version 25.9.0 fixes the issue.</p> <p>Maho is a free and open source ecommerce platform. In Maho prior to 25.9.0, an authenticated staff user with access to the `Dashboard` and `Catalog\Manage Products` permissions can create a custom option on a listing with a file input field. By allowing file uploads with a `.php` extension, the user can use the filed to upload malicious PHP files, gaining remote code execution. Version 25.9.0 fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-58449 https://cve.radiocsirt.org/vuln/ghsa-vgmm-27fc-vmgp <p><strong>Affected:</strong> Packagist: mahocommerce/maho</p> <p>### Summary In Maho 25.7.0, an authenticated staff user with access to the `Dashboard` and `Catalog\Manage Products` permissions can create a custom option on a listing with a file input field. By allowing file uploads with a `.php` extension, the user can use the filed to upload malicious PHP files, gaining remote code execution</p> <p>### Details An user with the `Dashboard` and `Catalog\Manage Products` permissions can abuse the product custom options feature to bypass the application’s file upload restrictions.</p> <p>When creating a product custom option of type file upload, the user is allowed to define their own extension whitelist. This bypasses the application’s normal enforced whitelist and permits disallowed extensions, including `.php`.</p> <p>The file uploaded by the custom option is then written to a predictable location: ``` /public/media/custom_options/&lt;first char of filename&gt;/&lt;second char of filename&gt;/&lt;md5 of file contents&gt;.php ``` Because this path is directly accessible under the application’s webroot, an attacker can then request the uploaded file via HTTP, causing the server to execute the PHP payload.</p> <p>### PoC 1. Sign in to the `/admin` dashboard as a staff user. Ensure the user&#39;s role has access to the `Dashboard` and `Catalog\Manage Products` permissions. 2. Navigate to a product catalog listing, for example by clicking on a product linked within the `Most Viewed Products` tab on the dashboard. &lt;img width=&#34;648&#34; height=&#34;194&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-att…</p> <p><strong>Affected:</strong> Packagist: mahocommerce/maho</p> <p>### Summary In Maho 25.7.0, an authenticated staff user with access to the `Dashboard` and `Catalog\Manage Products` permissions can create a custom option on a listing with a file input field. By allowing file uploads with a `.php` extension, the user can use the filed to upload malicious PHP files, gaining remote code execution</p> <p>### Details An user with the `Dashboard` and `Catalog\Manage Products` permissions can abuse the product custom options feature to bypass the application’s file upload restrictions.</p> <p>When creating a product custom option of type file upload, the user is allowed to define their own extension whitelist. This bypasses the application’s normal enforced whitelist and permits disallowed extensions, including `.php`.</p> <p>The file uploaded by the custom option is then written to a predictable location: ``` /public/media/custom_options/&lt;first char of filename&gt;/&lt;second char of filename&gt;/&lt;md5 of file contents&gt;.php ``` Because this path is directly accessible under the application’s webroot, an attacker can then request the uploaded file via HTTP, causing the server to execute the PHP payload.</p> <p>### PoC 1. Sign in to the `/admin` dashboard as a staff user. Ensure the user&#39;s role has access to the `Dashboard` and `Catalog\Manage Products` permissions. 2. Navigate to a product catalog listing, for example by clicking on a product linked within the `Most Viewed Products` tab on the dashboard. &lt;img width=&#34;648&#34; height=&#34;194&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-att…</p> https://cve.radiocsirt.org/vuln/ghsa-vgmm-27fc-vmgp