Critical · published December 3, 2025
🚨 A sneaky remote code execution vulnerability lurks in Masa CMS, allowing an attacker to execute arbitrary code without any authentication! 🔥 Think of this like a restaurant where anyone can walk in and change the menu items without a single check — the kitchen takes orders from anyone without verifying who they are! An attacker could potentially gain full control over your server, read sensitive data, or even alter your website's content — it's like someone taking over the conductor's podium during a symphony and changing the music mid-performance! This is absolutely devastating and needs immediate attention.
Think of this like a restaurant where anyone can walk in and change the menu items without a single check — the kitchen takes orders from anyone without verifying who they are! The vulnerability resides in the `addParam` function, which accepts user input via the `criteria` parameter. If exploited, it allows an unauthenticated attacker to execute arbitrary code through the `m` tag by manipulating the input before it gets evaluated by the `setDynamicContent` function.
An attacker could potentially gain full control over your server, read sensitive data, or even alter your website's content — it's like someone taking over the conductor's podium during a symphony and changing the music mid-performance! This is absolutely devastating and needs immediate attention. Upgrade immediately to versions 7.2.8, 7.3.13, or 7.4.6 to patch this vulnerability. Additionally, consider implementing input validation and access controls to prevent unauthorized code execution in the future. You've got this! With these steps, you'll have your Masa CMS fortified in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| masacms/masacms | < 7.2.8 | 7.2.8 |
| masacms/masacms | ≥ 7.3, < 7.3.13 | 7.3.13 |
| masacms/masacms | ≥ 7.4.0, < 7.4.6 | 7.4.6 |