CVE-2025-15009

A flaw has been found in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function FilenameUtils.getExtension of the file /dev-api/common/upload of the component Filename Handler. Executing manipulation of the argument File can lead to unrestricted upload. The attack may be launched remotely. The exploit has been published and may be used.

• CWE-284
• CWE-434

• https://github.com/yuccun/CVE/blob/main/ChestnutCMS-Arbitrary_File_Upload.mdExploit, Third Party Advisory
• https://github.com/yuccun/CVE/blob/main/ChestnutCMS-Arbitrary_File_Upload.md#vulnerability-proofExploit, Third Party Advisory
• https://vuldb.com/?ctiid.337715Permissions Required, VDB Entry
• https://vuldb.com/?id.337715Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.719590Third Party Advisory, VDB Entry

Published

Dec 22, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-15003A vulnerability was found in SeaCMS up to 13.3. The impacted…7.2
• CVE-2025-15004A vulnerability was identified in DedeCMS up to 5.7.118. Thi…8.8
• CVE-2025-15005A security flaw has been discovered in CouchCMS up to 2.4. A…3.7
• CVE-2025-15006A weakness has been identified in Tenda WH450 1.0.0.18. Affe…9.8
• CVE-2025-15007A security vulnerability has been detected in Tenda WH450 1.…9.8
• CVE-2025-15008A vulnerability was detected in Tenda WH450 1.0.0.18. This a…9.8
• CVE-2025-1501An access control vulnerability was discovered in the Reques…5.3
• CVE-2025-15010A vulnerability has been found in Tenda WH450 1.0.0.18. This…9.8
• CVE-2025-15011A vulnerability was found in code-projects Simple Stock Syst…9.8
• CVE-2025-15012A vulnerability was determined in code-projects Refugee Food…9.8
• CVE-2025-15013A vulnerability was identified in floooh sokol up to 5d11344…5.3
• CVE-2025-15014A security flaw has been discovered in loganhong php loganSi…6.3