CVE-2025-58048
Paymenter Vulnerable to Remote Code Execution via Public File Uploads
Description
Paymenter is a free and open-source webshop solution for hostings. Prior to version 1.2.11, the ticket attachments functionality in Paymenter allows a malicious authenticated user to upload arbitrary files. This could result in sensitive data extraction from the database, credentials being read from configuration files, and arbitrary system commands being run under the web server user context. This vulnerability was patched by commit 87c3db4 and was released under the version 1.2.11 tag without any other code modifications compared to version 1.2.10. If upgrading is not immediately possible, administrators can mitigate this vulnerability with one or more of the following measures: updating nginx config to download attachments instead of executing them or disallowing access to /storage/ fully using a WAF such as Cloudflare.
INFO
Published Date :
Aug. 28, 2025, 6:15 p.m.
Last Modified :
Sept. 26, 2026, 12:10 a.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | CRITICAL | [email protected] |
Solution
- Update Paymenter to version 1.2.11.
- Configure Nginx to download attachments instead of executing.
- Restrict access to /storage/ using a WAF.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-58048.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-58048 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-58048
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-58048 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2025-58048 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Sep. 26, 2026
Action Type Old Value New Value Added Translation Title: la funcionalidad de adjuntos de tickets en Paymenter, Description: Paymenter es una solución de tienda web de código abierto y gratuita para alojamientos. Antes de la versión 1.2.11, la funcionalidad de adjuntos de tickets en Paymenter permite a un usuario autenticado malicioso cargar archivos arbitrarios. Esto podría resultar en la extracción de datos sensibles de la base de datos, la lectura de credenciales de archivos de configuración y la ejecución de comandos de sistema arbitrarios bajo el contexto de usuario del servidor web. Esta vulnerabilidad fue parcheada por el commit 87c3db4 y fue lanzada bajo la etiqueta de la versión 1.2.11 sin ninguna otra modificación de código en comparación con la versión 1.2.10. Si la actualización no es posible de inmediato, los administradores pueden mitigar esta vulnerabilidad con una o más de las siguientes medidas: actualizar la configuración de nginx para descargar los adjuntos en lugar de ejecutarlos o denegar completamente el acceso a /storage/ utilizando un WAF como Cloudflare. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'Paymenter', 'product': 'Paymenter', 'versions': [{'status': 'affected', 'version': '< 1.2.11'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2025-58048', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2025-08-28T18:16:29.223115Z'} -
New CVE Received by [email protected]
Aug. 28, 2025
Action Type Old Value New Value Added Description Paymenter is a free and open-source webshop solution for hostings. Prior to version 1.2.11, the ticket attachments functionality in Paymenter allows a malicious authenticated user to upload arbitrary files. This could result in sensitive data extraction from the database, credentials being read from configuration files, and arbitrary system commands being run under the web server user context. This vulnerability was patched by commit 87c3db4 and was released under the version 1.2.11 tag without any other code modifications compared to version 1.2.10. If upgrading is not immediately possible, administrators can mitigate this vulnerability with one or more of the following measures: updating nginx config to download attachments instead of executing them or disallowing access to /storage/ fully using a WAF such as Cloudflare. Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Added CWE CWE-434 Added Reference https://github.com/Paymenter/Paymenter/commit/87c3db42282ada1e3cda54b9a01f846926c0669b Added Reference https://github.com/Paymenter/Paymenter/releases/tag/v1.2.11 Added Reference https://github.com/Paymenter/Paymenter/security/advisories/GHSA-5pm9-r2m8-rcmj