Miggo Logo

CVE-2025-29287: MCMS allows arbitrary file uploads in the ueditor component

9.8

CVSS Score
3.1

Basic Information

EPSS Score
0.44745%
Published
4/21/2025
Updated
4/21/2025
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
net.mingsoft:ms-mcmsmaven< 5.4.45.4.4

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability is an arbitrary file upload due to a misconfiguration in 'config.json' used by the UEditor component. The patch removes '.xml' from the allowed file types. The actual code that processes the upload and enforces this configuration resides in the UEditor's server-side scripts (like 'controller.jsp') and the Java libraries it uses (e.g., 'com.baidu.ueditor').

  1. 'controller.jsp' is the entry point that receives the upload request.
  2. 'com.baidu.ueditor.ActionEnter.exec' is a core UEditor Java function that orchestrates the handling of the request based on the action type and configuration.
  3. 'com.baidu.ueditor.upload.BinaryUploader.save' (or a similar method in an Uploader class) is likely where the file type check (based on 'config.json') and the actual file saving occur. This function would have allowed '.xml' files before the patch. The confidence is 'medium' because while the patch clearly points to 'config.json', the exact Java functions are inferred based on common UEditor architecture, as the 'controller.jsp' and specific Java backend code used by MCMS were not directly inspectable through the provided tools for this specific version/path.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*n *r*itr*ry *il* uplo** vuln*r**ility in t** u**itor *ompon*nt o* M*MS v*.*.* *llows *tt**k*rs to *x**ut* *r*itr*ry *o** vi* uplo**in* * *r**t** *il*.

Reasoning

T** vuln*r**ility is *n *r*itr*ry *il* uplo** *u* to * mis*on*i*ur*tion in '*on*i*.json' us** *y t** U**itor *ompon*nt. T** p*t** r*mov*s '.xml' *rom t** *llow** *il* typ*s. T** **tu*l *o** t**t pro**ss*s t** uplo** *n* *n*or**s t*is *on*i*ur*tion r*
CVE-2025-29287: MCMS ueditor File Upload RCE | Miggo