CVE-2025-52239
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
An arbitrary file upload vulnerability in ZKEACMS v4.1 allows attackers to execute arbitrary code via a crafted file.
Risk Assessment
An attacker can upload a malicious file, leading to remote code execution on the server, potentially compromising the entire system.
Recommendation
It is recommended to immediately update ZKEACMS to the latest version and implement file type validation and size restrictions.
Other vulnerabilities in ZKEACMS
See all- CVE-2026-111633High
ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers can sign a token with the Name claim set to 'admin' to call ApiAuthorize endpoints, modifying articles and products and reading form submissions.
- CVE-2025-10471Medium
A vulnerability was detected in ZKEACMS 4.3 in the Proxy function of MediaController.cs. Manipulating the url argument results in server-side request forgery. The attack can be initiated remotely and the exploit is publicly available.
Original NVD description (English source)
An arbitrary file upload vulnerability in ZKEACMS v4.1 allows attackers to execute arbitrary code via a crafted file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS