CVE-2025-29287

Critical · CVSS 9.8

MCMS — Arbitrary File Upload leading to Remote Code Execution

CVSS: 9.8; nvd
EPSS: —
KEV: No
Class: other; CWE-434

Description

An arbitrary file upload vulnerability in the ueditor component of MCMS v5.4.3 allows attackers to execute arbitrary code via uploading a crafted file.

Search profile — drives PoC discovery

Symbols ueditorueditor componentfile uploadcrafted fileMCMS v5.4.3

Keywords CVE-2025-29287MCMSueditorarbitrary file uploadRCEv5.4.3mingSoftIBOOTX

Versions: v5.4.3

References

https://gist.github.com/erdan111/38dcb5150b523436fe01249b2542f02f#file-cve-2025-29287
https://gitee.com/mingSoft/MCMS/issues/IBOOTX
https://gitee.com/mingSoft/MCMS/issues/IBOOTX

Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-06T00:30:39.000Z