CVE-2025-49926CWE-94code-injection

CVE-2025-49926

High · published October 22, 2025

CVSS v3.1
7.2
EPSS
0%
Percentile
18.6
In the wild
Unconfirmed
What it is

⚡ A crafty code injection vulnerability is lurking in Laborator Kalium! This affects all versions up to 3.25, and it could allow attackers to run malicious code with ease. 🔥 Think of Kalium like a restaurant where the chef takes orders without checking the ingredients. If someone slips in a dangerous ingredient without a second glance, it could ruin the entire meal—and that's exactly what this vulnerability allows! An attacker could exploit this flaw to execute arbitrary code, potentially compromising the entire server. This means they could steal sensitive data, alter configurations, or even take control of the system entirely—it's a recipe for disaster!

Put simply

Think of Kalium like a restaurant where the chef takes orders without checking the ingredients. If someone slips in a dangerous ingredient without a second glance, it could ruin the entire meal—and that's exactly what this vulnerability allows! This vulnerability allows attackers to inject code into the application due to improper input handling, making it possible to execute commands that the server should never have accepted.

What to do

An attacker could exploit this flaw to execute arbitrary code, potentially compromising the entire server. This means they could steal sensitive data, alter configurations, or even take control of the system entirely—it's a recipe for disaster! Update Kalium to version 3.26 or later immediately to patch this vulnerability. Additionally, review your code input sanitation processes to ensure no harmful code can be injected in the future. Conduct a thorough security audit of your application as a precaution. 🛡️ You've got this! Follow these steps and take control of your security today! 💪🌟

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00272 · 18.6th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2025-10-22T19:15Z
References (1)
EPSS history
Timeline
  • 22 OCT 14:32Z
    WordPress Kalium theme <= 3.25 - Arbitrary Code Execution vulnerability
    cvelistv5