What’s Vulnerable › Vulnerabilities

CVE-2025-41396

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-31 · updated 2026-06-17
• Weakness: CWE-22

Description

A path traversal issue exists in file uploading feature of multiple versions of PowerCMS. Arbitrary files may be overwritten by a product user.

Affected products

• Alfasado Inc. PowerCMS: from 4.0 before 4.61; from 5.0 before 5.31; from 6.0 before 6.71 — fixed in 4.61, 5.31, 6.71

How to fix

Upgrade to a fixed version: Alfasado Inc. PowerCMS 4.61, 5.31, 6.71. Check the vendor advisory for mitigations.

References

• https://jvn.jp/en/vu/JVNVU93412964/
• https://www.powercms.jp/news/release-powercms-671-531-461.html

Get alerted when CVE-2025-41396 or the next vulnerability affects your stack