CVE-2025-8266

yanyutao0402 ChanCMS collect.js getArticle deserialization

CVSS 5.3 MEDIUMEPSS 1.0%CWE-20 CWE-502

Vexday Risk Score

28Low

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 5.3EPSS 1.0%KEV nãoPoC —Nuclei simMetasploit —Patch referenciado

Lifecycle

28 Jul 2025Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

A vulnerability has been found in yanyutao0402 ChanCMS up to 3.1.2 and classified as critical. Affected by this vulnerability is the function getArticle of the file app/modules/cms/controller/collect.js. The manipulation of the argument targetUrl leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.3 is able to address this issue. It is recommended to upgrade the affected component.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Affected products

yanyutao0402 · ChanCMS

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://gitee.com/yanyutao0402/ChanCMS/issues/ICLP61 https://gitee.com/yanyutao0402/ChanCMS/releases/tag/V3.1.3 https://vuldb.com/?ctiid.317857 https://vuldb.com/?id.317857 https://vuldb.com/?submit.622170