What’s Vulnerable › Vulnerabilities

CVE-2025-11136: YiFang CMS Backend File.php webUploader unrestricted upload

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-09-29 · updated 2026-10-09
• Weakness: CWE-284

Description

A flaw has been found in YiFang CMS up to 2.0.2. The impacted element is the function webUploader of the file app/app/controller/File.php of the component Backend. Executing manipulation of the argument uploadpath can lead to unrestricted upload. The attack can be launched remotely. The exploit has been published and may be used.

Affected products

• wanglongcn Yifang: through 2.0.2

References

• https://github.com/electroN1chahaha/YifangCMS-V2.0.0-Remote-Code-Execution-RCE-/issues/1
• https://vuldb.com/?ctiid.326213
• https://vuldb.com/?id.326213
• https://vuldb.com/?submit.657903

Get alerted when CVE-2025-11136 or the next vulnerability affects your stack