CVE-2025-58048

{
  "id": "CVE-2025-58048",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-58048",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-08-28T18:16:29.223115Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.9,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.1
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "Paymenter",
          "product": "Paymenter",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.2.11"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-08-28T18:15:33.473",
  "references": [
    {
      "url": "https://github.com/Paymenter/Paymenter/commit/87c3db42282ada1e3cda54b9a01f846926c0669b",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Paymenter/Paymenter/releases/tag/v1.2.11",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Paymenter/Paymenter/security/advisories/GHSA-5pm9-r2m8-rcmj",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Paymenter is a free and open-source webshop solution for hostings. Prior to version 1.2.11, the ticket attachments functionality in Paymenter allows a malicious authenticated user to upload arbitrary files. This could result in sensitive data extraction from the database, credentials being read from configuration files, and arbitrary system commands being run under the web server user context. This vulnerability was patched by commit 87c3db4 and was released under the version 1.2.11 tag without any other code modifications compared to version 1.2.10. If upgrading is not immediately possible, administrators can mitigate this vulnerability with one or more of the following measures: updating nginx config to download attachments instead of executing them or disallowing access to /storage/ fully using a WAF such as Cloudflare."
    },
    {
      "lang": "es",
      "value": "Paymenter es una solución de tienda web de código abierto y gratuita para alojamientos. Antes de la versión 1.2.11, la funcionalidad de adjuntos de tickets en Paymenter permite a un usuario autenticado malicioso cargar archivos arbitrarios. Esto podría resultar en la extracción de datos sensibles de la base de datos, la lectura de credenciales de archivos de configuración y la ejecución de comandos de sistema arbitrarios bajo el contexto de usuario del servidor web. Esta vulnerabilidad fue parcheada por el commit 87c3db4 y fue lanzada bajo la etiqueta de la versión 1.2.11 sin ninguna otra modificación de código en comparación con la versión 1.2.10. Si la actualización no es posible de inmediato, los administradores pueden mitigar esta vulnerabilidad con una o más de las siguientes medidas: actualizar la configuración de nginx para descargar los adjuntos en lugar de ejecutarlos o denegar completamente el acceso a /storage/ utilizando un WAF como Cloudflare."
    }
  ],
  "lastModified": "2026-09-26T00:10:00.127",
  "sourceIdentifier": "security-advisories@github.com"
}