CVE-2025-65474
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
An arbitrary file rename vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below allows attackers to execute arbitrary code via renaming a PHP file to a SVG format.
Risk Assessment
Risk of arbitrary code execution on the server, potentially leading to full system compromise and data confidentiality breach.
Recommendation
Update EasyImages to the latest version and restrict access to the admin panel to trusted users only.
Other vulnerabilities in EasyImages
See all- CVE-2025-65473Critical
An arbitrary file rename vulnerability in the /admin/filer.php component of EasyImages 2.0 v2.8.6 and below allows attackers with Administrator privileges to execute arbitrary code via injecting a crafted payload into an uploaded file name.
- CVE-2025-65472High
A Cross-Site Request Forgery (CSRF) in the /admin/admin.inc.php component of EasyImages 2.0 v2.8.6 and below allows attackers to escalate privileges to Administrator via user interaction with a malicious web page.
- CVE-2025-65471High
An arbitrary file upload vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below allows attackers to execute arbitrary code via uploading a crafted PHP file.
- CVE-2023-33599Medium
EasyImages versions ≤ 2.8.1 is vulnerable to Cross Site Scripting (XSS) via viewlog.php.
Original NVD description (English source)
An arbitrary file rename vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below allows attackers to execute arbitrary code via renaming a PHP file to a SVG format.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS