CVE-2025-67164
Critical · 9.9Pagekit CMS is vulnerable to OS Command Injection via Storage component
CVSS
9.9
EPSS
0.5%
Published
Dec 17, 2025
CISA due date
—
The record
An authenticated arbitrary file upload vulnerability in the /storage/poc.php component of Pagekit CMS v1.0.18 allows attackers to execute arbitrary code via uploading a crafted PHP file. The project is archived as of December 1, 2023.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | pagekit/pagekit | 0 | No fix |
Related vulnerabilities
- GHSA-m4f2-xpfq-h97v Pagekit CMS is vulnerable to OS Command Injection via Storage component Same vulnerability
- GHSA-w3j8-9p3j-3wjx Pagekit CMS has an Insecure Direct Object Reference (IDOR) in its User Role component Also affects pagekit/pagekit
- CVE-2025-67165 Pagekit CMS has an Insecure Direct Object Reference (IDOR) in its User Role component Also affects pagekit/pagekit
- CVE-2026-8778 The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields. CWE-434
- CVE-2026-12215 The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication… CWE-434
- CVE-2026-18351 The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to… CWE-434
- CVE-2026-71805 An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0. CWE-434
- CVE-2026-26212 Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file… CWE-434