Critical severity · published Feb 7, 2025
CVE-2025-1113
taisan tarzan-cms Add Theme admin#themes upload deserialization
9.8
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability was found in taisan tarzan-cms up to 1.0.0. It has been rated as critical. This issue affects the function upload of the file /admin#themes of the component Add Theme Handler. The manipulation leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TA
tarzan-cms · taisan
1.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-1113
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-1113
Exploit
https://gitee.com/taisan/tarzan-cms/issues/IBHZ0J
Permissions Required
https://vuldb.com/?ctiid.295019
Third Party Advisory
https://vuldb.com/?id.295019
More from tarzan-cms
9.8
CVE-2024-13022
taisan tarzan-cms Article Management UploadController.java UploadResponse unrestricted upload
7.3
CVE-2026-90710
taisan tarzan-cms Theme Download Function ThemeService.java openConnection server-side request forgery