CVE-2025-52239
Critical · CVSS 9.8ZKEACMS — Arbitrary File Upload RCE (CWE-434)
- CVSS
- 9.8
- nvd
- EPSS
- 0.45%
- 36th pct
- KEV
- No
- Class
- oss containerizable
- CWE-434
Description
An arbitrary file upload vulnerability in ZKEACMS v4.1 allows attackers to execute arbitrary code via a crafted file.
Search profile — drives PoC discovery
Symbols file uploadcrafted filearbitrary code executionZKEACMSupload endpointwebshell upload
Keywords CVE-2025-52239ZKEACMSarbitrary file uploadv4.1RCEfile upload vulnerabilityZKEACMS exploitZKEACMS webshellCWE-434ZKEACMS PoC
Versions: v4.1
Ranked PoCs (1) — best first
Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.
- ★ 0fkie-cad/nvd-json-data-feeds needs reviewtrickest
Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.
References
Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-06T06:30:39.000Z