CVE-2025-65471
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
An arbitrary file upload vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below allows attackers to execute arbitrary code via uploading a crafted PHP file.
Risk Assessment
Allows an attacker to achieve remote code execution on the server, potentially leading to full system compromise and data theft.
Recommendation
Update EasyImages to a version newer than 2.8.6 or remove/restrict access to /admin/manager.php and implement file upload validation.
Other vulnerabilities in EasyImages
See all- CVE-2025-65474Critical
An arbitrary file rename vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below allows attackers to execute arbitrary code via renaming a PHP file to a SVG format.
- CVE-2025-65473Critical
An arbitrary file rename vulnerability in the /admin/filer.php component of EasyImages 2.0 v2.8.6 and below allows attackers with Administrator privileges to execute arbitrary code via injecting a crafted payload into an uploaded file name.
- CVE-2025-65472High
A Cross-Site Request Forgery (CSRF) in the /admin/admin.inc.php component of EasyImages 2.0 v2.8.6 and below allows attackers to escalate privileges to Administrator via user interaction with a malicious web page.
- CVE-2023-33599Medium
EasyImages versions ≤ 2.8.1 is vulnerable to Cross Site Scripting (XSS) via viewlog.php.
Original NVD description (English source)
An arbitrary file upload vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below allows attackers to execute arbitrary code via uploading a crafted PHP file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS