VaahCMS is vulnerable to XSS through its Avatar Upload endpoint

MEDIO 6.1CVE-2025-61183 · GHSA-q769-phqg-263r · Published 08/10/2025 · updated 05/11/2026

In breve

CVE-2025-61183 è una vulnerabilità MEDIO (CVSS 6.1) che riguarda webreinvent/vaahcms, vaahcms (webreinvent).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.30%, superiore al 22.8% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
webreinvent/vaahcms Packagist	`≤ 2.3.1`	No fix yet
vaahcms webreinvent	`= 2.3.1`	No fix yet

Description

Cross-Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary code via upload method in the storeAvatar() method of UserBase.php

NVD description

Cross Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary code via upload method in the storeAvatar() method of UserBase.php

References

nvd.nist.gov/vuln/detail/CVE-2025-61183 · ADVISORY
webreinvent/vaahcms · WEB
thawphone/CVE-2025-61183 · WEB
webreinvent/vaahcms · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free