CVE-2025-29281

HIGH

PerfreeBlog 4.0.11 - Authenticated Arbitrary File Upload and Code Execution via Attach Component

Title source: llm

Description

In PerfreeBlog version 4.0.11, regular users can exploit the arbitrary file upload vulnerability in the attach component to upload arbitrary files and execute code within them.

References (1)

Core 1

Core References

Exploit, Third Party Advisory

https://github.com/Cray0nLee/CVE/issues/2

Scores

CVSS v3 8.8

EPSS 0.0057

EPSS Percentile 43.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact total

Details

CWE

CWE-94

Status published

Products (1)

perfree/perfreeblog 4.0.11

Published Apr 15, 2025

Tracked Since Feb 18, 2026