Unrated severityNVD Advisory· Published Sep 30, 2025· Updated Sep 30, 2025
Remote Code Execution via Unrestricted File Upload in PAD CMS
CVE-2025-8120
Description
Due to client-controlled permission check parameter, PAD CMS's upload photo functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can then be executed leading to Remote Code Execution.This issue affects all 3 templates: www, bip and ww+bip.
This product is End-Of-Life and producent will not publish patches for this vulnerability.
Affected products
1- Polska Akademia Dostępności/PAD CMSv5Range: 0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1News mentions
0No linked articles in our index yet.