4.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-51489

CVE-2025-51489: MoonShine Arbitrary File Upload Vulnerability

An arbitrary file upload vulnerability in MoonShine v3.12.4 allows attackers to execute arbitrary code via uploading a crafted SVG file.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-51489

CVE-2025-51489:

4.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
moonshine/moonshine	composer	< 3.12.5	3.12.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an arbitrary file upload issue in MoonShine, specifically allowing the upload of crafted SVG files which can lead to code execution. The root cause is improper validation of uploaded files. The provided patch addresses this by enforcing stricter validation rules on the uploaded files.

My analysis of the commit 7102fb113627870fb1cb7176e1d0d95bb47a7fd4 reveals changes in two key files:

src/Laravel/src/Http/Requests/ProfileFormRequest.php
src/Laravel/src/Resources/MoonShineUserResource.php

In both files, the rules() method was updated to include 'mimes:jpeg,jpg,png,gif' for the 'avatar' field. This change restricts the allowed file types for user avatars, preventing the upload of SVG files and thus mitigating the vulnerability. The vulnerable functions are the rules methods within these two classes, as they were the ones that failed to properly validate the file type of the uploaded avatar, which is the entry point for the vulnerability. An attacker could exploit this by uploading a malicious SVG file disguised as an avatar, which would then be stored on the server and could potentially be executed.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.