CVE-2025-8266
MEDIUM EXPLOITED NUCLEIchancms < 3.1.3 - Deserialization via getArticle Function
Title source: llmExploitation Summary
CVE-2025-8266 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including Acczdy. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional Python exploit for CVE-2025-8266, a code injection vulnerability in ChanCMS ≤ 3.1.2. The exploit leverages the `parseData` parameter in the `getArticle` function to execute arbitrary system commands via JavaScript injection.
Description
A vulnerability has been found in yanyutao0402 ChanCMS up to 3.1.2 and classified as critical. Affected by this vulnerability is the function getArticle of the file app/modules/cms/controller/collect.js. The manipulation of the argument targetUrl leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.3 is able to address this issue. It is recommended to upgrade the affected component.
Exploits (1)
This repository contains a functional Python exploit for CVE-2025-8266, a code injection vulnerability in ChanCMS ≤ 3.1.2. The exploit leverages the `parseData` parameter in the `getArticle` function to execute arbitrary system commands via JavaScript injection.
Nuclei Templates (1)
html:"ChanCMS"
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L