CVE-2025-29287
CVSS 3.1 Score 9.8 of 10 (high)
Details
Published Apr 21, 2025
Updated: Apr 24, 2025
CWE ID 434
Summary
CVE-2025-29287 is an arbitrary file upload vulnerability affecting MCMS v5.4.3, which includes the ueditor component. Attackers can exploit this weakness by uploading specially crafted files, granting them the ability to execute arbitrary code. Successful exploitation may lead to significant security risks, such as system compromise and data theft. MCMS users are urged to update to a patched version as soon as possible to mitigate this risk. Failure to do so may leave systems vulnerable to attacks.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- MCMs