CVE-2025-69770 - A zip slip vulnerability in the /DesignTools/SkinList.aspx endpoint of MojoPortal CMS v2.9.0.1 allows attackers to execute arbitrary commands via uploading a crafted zip file

Back Back to CVE browser

CRITICAL

A zip slip vulnerability in the /DesignTools/SkinList.aspx endpoint of MojoPortal CMS v2.9.0.1 allows attackers to execute arbitrary commands via uploading a crafted zip file

Published Feb 13, 2026

10.0

CRITICAL

CVSS 3.1

EPSS 0.67%

Description

A zip slip vulnerability in the /DesignTools/SkinList.aspx endpoint of MojoPortal CMS v2.9.0.1 allows attackers to execute arbitrary commands via uploading a crafted zip file.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (4)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-206963		Advisory
https://github.com/i7MEDIA/mojoportal/security
https://github.com/kid-tnt/Mojo-check/blob/main/Zipslip%20in%20MojoPortal%20version%202.9.0.1.md
https://www.mojoportal.com/mojoportal-2-9-1