Pagekit CMS is vulnerable to OS Command Injection via Storage component

CRITICAL 9.9CVE-2025-67164 · GHSA-m4f2-xpfq-h97v · Published 17/12/2025 · updated 13/10/2026

Package	Affected versions	Patched versions
pagekit/pagekit Packagist	`≤ 1.0.18`	No fix yet
pagekit pagekit	`= 1.0.18`	No fix yet

Description

An authenticated arbitrary file upload vulnerability in the /storage/poc.php component of Pagekit CMS v1.0.18 allows attackers to execute arbitrary code via uploading a crafted PHP file.

The project is archived as of December 1, 2023.

NVD description

An authenticated arbitrary file upload vulnerability in the /storage/poc.php component of Pagekit CMS v1.0.18 allows attackers to execute arbitrary code via uploading a crafted PHP file.

References

nvd.nist.gov/vuln/detail/CVE-2025-67164 · ADVISORY
mbiesiad/vulnerability-research · WEB
pagekit/pagekit · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free