CVE-2025-51511
Critical · 9.8Cadmium CMS has a background arbitrary file upload vulnerability
CVSS
9.8
EPSS
0.4%
Published
Dec 23, 2025
CISA due date
—
The record
Cadmium CMS v.0.4.9 has a background arbitrary file upload vulnerability in /admin/content/filemanager/uploads.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | cadmium-org/cadmium-cms | 0 | No fix |
Related vulnerabilities
- GHSA-qx44-p258-3c2v Cadmium CMS has a background arbitrary file upload vulnerability Same vulnerability
- CVE-2026-8778 The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields. CWE-434
- CVE-2026-12215 The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication… CWE-434
- CVE-2026-18351 The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to… CWE-434
- CVE-2026-71805 An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0. CWE-434
- CVE-2026-26212 Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file… CWE-434
- CVE-2026-54611 InstantCMS is a free and open source content management system. CWE-434
- CVE-2026-86666 A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.15. CWE-434