External risk intelligence

ChanCMS Template Injection Allows Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-65602

ChanCMS is a content management system. These systems are commonly deployed as internet-facing web applications to serve public web content. The vulnerable component is an API endpoint (/vip/v1/file/save) that is typically exposed as part of the web service's functionality, making it reachable by external users in standard web deployments.

Code Injection

Chancms

3.3.4

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the ChanCMS content management system that could allow unauthorized code execution on affected systems. This issue impacts a specific component used for file saving operations. The primary concern at this stage is to determine if this technology is in use within our environment and to what extent it may be exposed.

Code execution flaw in file saving.
Affects content management systems.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted POST request to the `/vip/v1/file/save` component. This component is exposed externally, meaning an attacker does not need any prior access or authentication to reach it. By manipulating the request, the attacker can trigger a template injection, which, when successful, allows for arbitrary code execution on the server.

Attacker sends a crafted POST request.
Vulnerable component accepts unauthenticated input.
Enables arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A template injection vulnerability in the file saving component could allow an unauthenticated attacker to execute arbitrary code by sending a specially crafted POST request. This could lead to the compromise of the entire system.

System code execution.
Crafted POST request sent.
Complete system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

The ChanCMS product owner, likely part of the application or platform team, is responsible for addressing this template injection vulnerability. The first practical step is to inventory all ChanCMS deployments, confirm their network exposure and business criticality, and identify the specific asset owners. Subsequent remediation planning should prioritize high-risk instances, potentially involving vendor coordination or temporary mitigation strategies.

Application owners should address the issue.
Verify ChanCMS deployment and reachability first.
Plan remediation based on asset criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ChanCMS?

ChanCMS is a content management system designed to help users build and maintain websites. It functions as a server-side application that manages digital content and web assets, often including features for saving files or processing data through specific API endpoints.

What does template injection mean in CVE-2025-65602?

This vulnerability is classified as improper neutralization of user input, specifically CWE-94 and CWE-1336. It occurs when the software takes untrusted input and embeds it into a template engine without proper validation. Instead of treating the input as plain text, the server interprets it as executable code, allowing an attacker to run unauthorized commands.

How is this vulnerability triggered?

An attacker triggers this flaw by sending a specially crafted POST request to the application's file-saving endpoint. It does not require the attacker to be authenticated or have prior access to the system. Simply browsing the website or performing standard read-only GET requests will not trigger the vulnerability; it requires the specific malicious POST submission.

Is my instance of ChanCMS at risk?

According to Halo Surface Signal, ChanCMS is typically deployed as an internet-facing web application. Because the affected file-saving endpoint is a standard part of the service's functionality, any instance exposed to the public internet is considered reachable and at higher risk of unauthorized interaction.

How should I respond to this threat?

Begin by conducting an inventory of all ChanCMS installations in your environment to identify where they are deployed. Once located, verify their network reachability to determine which instances are internet-facing. Coordinate with your application or platform teams to prioritize these assets for remediation, focusing on high-risk and public-facing systems first.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.