CVE-2022-25581

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-03-18 · updated 2026-06-17
Weakness: CWE-434

Description

Classcms v2.5 and below contains an arbitrary file upload via the component \class\classupload. This vulnerability allows attackers to execute code injection via a crafted .txt file.

Affected products

ClassCMS: through 2.5

References

https://github.com/k0xx11/Vulscve/blob/master/classcms2.5-rce.md
https://github.com/k0xx11/Vulscve/blob/master/classcms2.5-rce.md

Get alerted when CVE-2022-25581 or the next vulnerability affects your stack