CVE-2025-12923: A vulnerability was determined in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function resourceDownload of the file…

PriorityP434medium4.9CVSS 3.1

AVNACLPRHUINSUCHINAN

EPSS

0.51%

39.7th percentile

A vulnerability was determined in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function resourceDownload of the file /dev-api/common/download. Executing manipulation of the argument path can lead to path traversal. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
1000mz	chestnutcms	<= 1.5.8	—
liweiyi	chestnutcms	—	—
liweiyi	chestnutcms	—	—
liweiyi	chestnutcms	—	—
liweiyi	chestnutcms	—	—
liweiyi	chestnutcms	—	—
liweiyi	chestnutcms	—	—
liweiyi	chestnutcms	—	—
liweiyi	chestnutcms	—	—
liweiyi	chestnutcms	—	—

CVSS provenance

nvdv3.14.9MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

nvdv4.02.0LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

nvdv2.03.3LOWAV:N/AC:L/Au:M/C:P/I:N/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.