External risk intelligence

Jizhicms v2.5.4 Arbitrary File Upload Vulnerability Allows Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-25784

Jizhicms is a content management system. CMS platforms are commonly deployed as public-facing web applications to serve content to internet users, making their file upload endpoints and administrative interfaces reachable from the public internet in typical deployments.

Unrestricted File Upload

Jizhicms

2.5.4

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in Jizhicms software, specifically related to file uploads, that could allow unauthorized code execution. This impacts the integrity and availability of systems using this component, with the potential for significant disruption. The main concern is confirming relevance and exposure.

Upload flaw allows code execution.
Critical flaw could compromise systems.
Verify if Jizhicms is in use.

Attack Path

How an attacker could exploit the issue

An attacker could reach an arbitrary file upload function exposed by the Jizhicms content management system, likely through a network connection, without needing any prior authentication or interaction. By uploading a specially crafted ZIP archive, the attacker could trigger the vulnerability in the `TemplateController.php` component, potentially leading to the execution of arbitrary code on the server.

Unauthenticated network access required.
Upload crafted ZIP file to `TemplateController.php`.
Risk: Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to upload and execute arbitrary code on affected systems when they can upload crafted zip files. This could lead to a compromise of the web server and its hosted content.

Arbitrary code execution on the server.
Uploading crafted zip files via the application.
Server compromise and data exposure.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Jizhicms component, specifically `TemplateController.php`, is vulnerable to arbitrary file uploads, allowing for code execution. This critical vulnerability requires immediate attention from teams managing web applications and content management systems. The first practical step is to identify all Jizhicms installations, determine their exposure and business criticality, and then assign ownership for remediation, followed by risk-based planning.

Application owners should manage remediation.
Verify Jizhicms installations and exposure.
Plan coordinated updates or vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Jizhicms and how is it used?

Jizhicms is a content management system designed to help users build, organize, and publish web content. It functions as a platform that manages site architecture and dynamic pages. Because it is a CMS, it often includes features that allow administrators or users to upload files and templates to customize the website's appearance or functionality.

What does CWE-434 mean regarding CVE-2025-25784?

CWE-434 refers to 'Unrestricted Upload of File with Dangerous Type.' In the context of CVE-2025-25784, this means the software fails to properly check or limit the types of files uploaded to the server. Because the system does not sufficiently validate the contents or file extensions of uploads, an attacker can bypass security controls to place malicious files directly onto the system.

How can an attacker trigger this vulnerability?

An attacker triggers this flaw by sending a specially crafted ZIP file to the vulnerable TemplateController.php component. This process does not require the attacker to have an existing user account or any prior authorization. It is important to note that simply visiting the site or interacting with standard web pages does not trigger this; the exploit specifically requires the active submission of a malicious archive file through the affected upload interface.

Is my instance of Jizhicms at risk?

If you are running Jizhicms v2.5.4, your instance may be at risk. Halo Surface Signal notes that CMS platforms are typically deployed as public-facing web applications to serve content to internet users. Because the file upload endpoints are often reachable from the public internet in standard configurations, any Jizhicms installation that is accessible via a network connection should be treated as potentially reachable by an external attacker.

What are the first steps to address this flaw?

Start by identifying all instances of Jizhicms within your environment to understand your total footprint. Once located, determine if these instances are exposed to the internet and assess their business importance. Assign clear ownership for each identified installation so your team can plan for necessary updates or engage with the vendor for remediation guidance. Prioritize isolating any internet-facing installations until a secure resolution is implemented.

References

www.jizhicms.cn/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.