CVE-2025-5327: chshcms mccms Gf.php index server-side request forgery

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-05-29 · updated 2026-06-17
Weakness: CWE-918

Description

A vulnerability was found in chshcms mccms 2.7. It has been classified as critical. This affects the function index of the file sys/apps/controllers/api/Gf.php. The manipulation of the argument pic leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

mccms: 2.7

References

https://github.com/caigo8/CVE-md/blob/main/Mccms_V2.7/%E5%89%8D%E5%8F%B0SSRF.md
https://vuldb.com/?ctiid.310497
https://vuldb.com/?id.310497
https://vuldb.com/?submit.582295
https://github.com/caigo8/CVE-md/blob/main/Mccms_V2.7/%E5%89%8D%E5%8F%B0SSRF.md

Get alerted when CVE-2025-5327 or the next vulnerability affects your stack