CVE-2025-25784

Critical · CVSS 9.8

Jizhicms — Arbitrary File Upload RCE via crafted Zip file

CVSS: 9.8; nvd
EPSS: —
KEV: No
Class: oss containerizable; CWE-434

Description

An arbitrary file upload vulnerability in the component \c\TemplateController.php of Jizhicms v2.5.4 allows attackers to execute arbitrary code via uploading a crafted Zip file.

Search profile — drives PoC discovery

Symbols TemplateController.phpc\TemplateController.phpJizhicmsv2.5.4zip uploadfile upload

Keywords CVE-2025-25784Jizhicmsarbitrary file uploadTemplateControllerZip upload RCECWE-434Jizhicms v2.5.4template zip upload vulnerability

Versions: v2.5.4

Ranked PoCs (1) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

Ka7arotto/JizhiCms candidate

cited in references

trickest

★ 0

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

References

Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-06T00:30:39.000Z