CVE-2025-63678

High · 7.2

CVSS

7.2

EPSS

0.5%

Published

Nov 10, 2025

CISA due date

—

The record

An authenticated arbitrary file upload vulnerability in the /uploads/ endpoint of CMS Made Simple Foundation File Manager v2.2.22 allows attackers with Administrator privileges to execute arbitrary code via uploading a crafted PHP file.

Affected packages

Ecosystem	Package	Introduced	Fixed