Critical severityGHSA Advisory· Published Oct 8, 2025· Updated Apr 15, 2026

CVE-2025-10353

Description

File upload leading to remote code execution (RCE) in the “melis-cms-slider” module of Melis Technology's Melis Platform. This vulnerability allows an attacker to upload a malicious file via a POST request to '/melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm' using the 'mcsdetail_img' parameter.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
melisplatform/melis-cms-sliderPackagist	< 5.3.1	5.3.1

Affected products

Melisplatform/Melis CMS SliderGHSA
Range: < 5.3.1
ghsa-coords
pkg:composer/melisplatform/melis-cms-slider
Range: < 5.3.1

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-chw4-gjvw-3gxcghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-10353ghsaADVISORY
github.com/melisplatform/melis-cms-slider/commit/c8757338ccd2dae5d347db5f494922ecc692f614ghsaWEB
www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-melis-platformnvdWEB

News mentions

No linked articles in our index yet.

cvss	0.585
epss	0.002
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000