CVE-2025-12331CWE-284CWE-434broken-access-controlunrestricted-file-upload

CVE-2025-12331

Medium · published October 28, 2025

CVSS v3.1

4.7

EPSS

Percentile

31.5

In the wild

Unconfirmed

What it is

A weakness has been identified in Willow CMS up to 1.4.0. Impacted is an unknown function of the file /admin/images/add. This manipulation causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.

The record

Technical detail

CVSS v3.1: 4.7 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0: Not supplied
EPSS: 0.00389 · 31.5th percentile
Weaknesses: CWE-284 · Improper Access Control; CWE-434 · Unrestricted Upload of File with Dangerous Type
Published: 2025-10-28T02:15Z

Affected products (1)

Product	Versions	Fixed in
matthewdeaves/willow_cms	≤ 1.4.0	—

References (5)

https://github.com/matthewdeaves/willow/issues/132 · [email protected]https://vuldb.com/?ctiid.330116 · [email protected]https://vuldb.com/?id.330116 · [email protected]https://vuldb.com/?submit.674439 · [email protected]https://www.youtube.com/watch?v=zacD0QLUYs8 · [email protected]

EPSS history

Timeline

27 OCT 22:02Z
Willow CMS add unrestricted upload
cvelistv5