External risk intelligence

FoxCMS LocalTemplate Arbitrary File Upload Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-25790

FoxCMS is a content management system. CMS platforms are commonly deployed as public-facing web applications to serve content to internet users, making their web components, such as file upload functionality, frequently reachable from the public internet.

Unrestricted File Upload

Foxcms

1.2.5

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security flaw has been identified in FoxCMS software that could allow an unauthorized user to upload malicious files and potentially gain control of affected systems. This vulnerability is critical and affects a component responsible for handling local templates.

Attackers can upload harmful files.
Confirms exposure of a common web application component.
Verify relevance; review system exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by uploading a specially crafted ZIP file through the LocalTemplate.php component. This action allows for the execution of arbitrary code on the server, posing a significant risk to the system.

No authentication is required.
Upload a crafted ZIP file.
Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A vulnerability in FoxCMS's file upload functionality could allow for arbitrary code execution when an attacker uploads a specially crafted ZIP file. This could impact the integrity and availability of the affected system.

System files could be overwritten.
Crafted ZIP files could be uploaded.
Code execution may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability resides in FoxCMS, a content management system. Given its nature as a web application, ownership typically falls to application owners or platform teams responsible for its deployment and maintenance. The first practical step is to identify all FoxCMS instances, assess their exposure and business criticality, and then assign ownership for remediation planning.

Application or platform teams own the issue.
Verify FoxCMS instance reachability and criticality.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is FoxCMS?

FoxCMS is a content management system (CMS) designed to help users build and manage websites. It functions as a web application platform where administrators can organize digital content, manage site structures, and handle templates. Because it manages site layouts and files, it includes components like template controllers that process user-submitted data to update the website's appearance or functionality.

How does this CVE-2025-25790 vulnerability work?

This vulnerability is classified as an Unrestricted Upload of File with Dangerous Type (CWE-434). It means the software does not properly check or sanitize the files being uploaded to its servers. Specifically, an attacker can upload a malicious ZIP file containing code that the system then incorrectly processes. By bypassing these security controls, the uploaded file can be executed, granting the attacker the ability to run their own commands on the underlying server.

What triggers this arbitrary file upload flaw?

The flaw is triggered when the LocalTemplate.php component receives a specially crafted ZIP file. Because the application lacks the necessary verification steps for these uploads, it processes the archive's contents as if they were legitimate template files. It is important to note that this process does not require the attacker to have an existing user account or administrative credentials; the system permits the upload attempt from an unauthenticated state.

Do I need to worry if my FoxCMS instance is internal?

According to Halo Surface Signal, you should prioritize this based on your network architecture. Because FoxCMS is a CMS, it is typically designed to serve content to the public, which often places its web components in reachable, internet-facing positions. If your instance is exposed to the internet, the risk is significantly higher. Even for internal systems, you should evaluate if unauthorized users on your local network could reach the application's file upload interface.

When should I take action on CVE-2025-25790?

You should act immediately by locating every instance of FoxCMS running in your environment. Since this vulnerability allows for full code execution, it poses a high risk to system integrity. Begin by identifying which teams manage these applications, then confirm their current network exposure and business criticality. Use this information to coordinate with your infrastructure or platform teams to plan and apply the necessary security updates to secure your server.

References

www.foxcms.cn/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.