CVE-2025-29287: MCMS allows arbitrary file uploads in the ueditor component

The vulnerability is an arbitrary file upload due to a misconfiguration in 'config.json' used by the UEditor component. The patch removes '.xml' from the allowed file types. The actual code that processes the upload and enforces this configuration resides in the UEditor's server-side scripts (like 'controller.jsp') and the Java libraries it uses (e.g., 'com.baidu.ueditor').

1. 'controller.jsp' is the entry point that receives the upload request.
2. 'com.baidu.ueditor.ActionEnter.exec' is a core UEditor Java function that orchestrates the handling of the request based on the action type and configuration.
3. 'com.baidu.ueditor.upload.BinaryUploader.save' (or a similar method in an Uploader class) is likely where the file type check (based on 'config.json') and the actual file saving occur. This function would have allowed '.xml' files before the patch. The confidence is 'medium' because while the patch clearly points to 'config.json', the exact Java functions are inferred based on common UEditor architecture, as the 'controller.jsp' and specific Java backend code used by MCMS were not directly inspectable through the provided tools for this specific version/path.