CVE-2025-1336

Summary

CVE-2025-1336 is a newly disclosed vulnerability that impacts the CmsEasy 7.7.7.9 software. The issue lies in the function deleteimg_action within the library lib/admin/image_admin.php. This vulnerability enables path traversal by manipulating the imgname argument. It is remotely exploitable, meaning an attacker can target the system from outside the network. The public disclosure of the exploit increases the risk, as the vendor, despite being notified early, has not responded or issued a patch.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.