High severityOSV Advisory· Published Sep 8, 2025· Updated Apr 15, 2026

CVE-2025-58449

Description

Maho is a free and open source ecommerce platform. In Maho prior to 25.9.0, an authenticated staff user with access to the Dashboard and Catalog\Manage Products permissions can create a custom option on a listing with a file input field. By allowing file uploads with a .php extension, the user can use the filed to upload malicious PHP files, gaining remote code execution. Version 25.9.0 fixes the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
mahocommerce/mahoPackagist	< 25.9.0	25.9.0

Affected products

Mahocommerce/MahoOSV
Range: 24.11.0, 24.9.0, 25.1.0, …
ghsa-coords
pkg:composer/mahocommerce/maho
Range: < 25.9.0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-vgmm-27fc-vmgpghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-58449ghsaADVISORY
github.com/MahoCommerce/maho/commit/db54a1b44e9b3fd26b27ca4d5ece0af99c4dcb53nvdWEB
github.com/MahoCommerce/maho/security/advisories/GHSA-vgmm-27fc-vmgpnvdWEB

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000