Executive brief
KodiCMS is a content management system for building and managing websites. The vulnerability allows an attacker to inject malicious code through the Layout API Endpoint, potentially enabling arbitrary code execution on the server. This could lead to complete compromise of the website and exposure of sensitive data stored within the CMS.
Technical details
This is a code injection vulnerability in the Save function of the KodiCMS Layout API Endpoint (cms/modules/kodicms/classes/kodicms/model/file.php). The vulnerability exists because user-supplied content argument is not properly validated or sanitized before being processed, allowing an attacker to inject arbitrary code. The attack is network-reachable and can be initiated remotely without authentication requirements. An attacker can achieve arbitrary code execution on the affected server. The vendor was contacted early but did not provide a response regarding patch availability.
Affected products
- Kohana KodiCMS up to 13.82.135
Timeline
- 2025-12-31: disclosed: CVE-2025-15393 publicly disclosed