High severity8.8NVD Advisory· Published Dec 9, 2025· Updated Jul 5, 2026
CVE-2025-56704
CVE-2025-56704
Description
LeptonCMS version 7.3.0 contains an arbitrary file upload vulnerability, which is caused by the lack of proper validation for uploaded files. An authenticated attacker can exploit this vulnerability by uploading a specially crafted ZIP/PHP file to execute arbitrary code.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3=7.3.0+ 2 more
- (no CPE)range: =7.3.0
- (no CPE)
- cpe:2.3:a:lepton-cms:leptoncms:7.3.0:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
3- github.com/Kayi626/Vulns/blob/UserAccount/LEPTON_CMS_7.3.0_File_Upload_A.pdfnvdExploitThird Party Advisory
- github.com/Kayi626/Vulns/blob/UserAccount/LEPTON_CMS_7.3.0_File_Upload_B.pdfnvdExploitThird Party Advisory
- github.com/Kayi626/Vulns/blob/UserAccount/LEPTON_CMS_7.3.0_File_Upload_C.pdfnvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.