CVE-2025-10116 - SiempreCMS file_upload.php unrestricted upload

Back Back to CVE browser

MEDIUM

SiempreCMS file_upload.php unrestricted upload

Published Sep 9, 2025

6.9

MEDIUM

CVSS 4.0

EPSS 0.46%

Description

A vulnerability was identified in SiempreCMS up to 1.3.6. This vulnerability affects unknown code of the file /docs/admin/file_upload.php. Such manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit is publicly available and might be used.

Affected products

Vendor n/a Product SiempreCMS Default
n/a
- Version
  1.3.0
  Status
  affected
  Constraints
  -
- Version
  1.3.1
  Status
  affected
  Constraints
  -
- Version
  1.3.2
  Status
  affected
  Constraints
  -
- Version
  1.3.3
  Status
  affected
  Constraints
  -
- Version
  1.3.4
  Status
  affected
  Constraints
  -
- Version
  1.3.5
  Status
  affected
  Constraints
  -
- Version
  1.3.6
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

SiempreCMS

n/a

Version	Status	Constraints
1.3.0	affected	-
1.3.1	affected	-
1.3.2	affected	-
1.3.3	affected	-
1.3.4	affected	-
1.3.5	affected	-
1.3.6	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-284

CWE-434

Unrestricted Upload of File

References (4)

https://github.com/drew-byte/SiempreCMS-File-Upload-Abuse/blob/main/README.md
exploit
https://vuldb.com/?ctiid.323085
signaturepermissions-required
https://vuldb.com/?id.323085
vdb-entry
https://vuldb.com/?submit.645540
third-party-advisory

Link	Providers	Tags
https://github.com/drew-byte/SiempreCMS-File-Upload-Abuse/blob/main/README.md		exploit
https://vuldb.com/?ctiid.323085		signaturepermissions-required
https://vuldb.com/?id.323085		vdb-entry
https://vuldb.com/?submit.645540		third-party-advisory