Executive brief
LeptonCMS, a content management system used for building and managing websites, contains a security flaw in its file upload mechanism. An authorized user can bypass security checks to upload malicious files, such as PHP scripts, to the server. If exploited, this allows an attacker to take full control of the website, potentially leading to data theft or a complete service shutdown.
Technical details
An unrestricted file upload vulnerability (CWE-434) exists in LeptonCMS 7.3.0 due to insufficient validation of file extensions and content during the upload process. An authenticated attacker with low-level privileges can upload malicious PHP scripts, potentially disguised within ZIP archives, to the web server. Because the application fails to properly sanitize these uploads or restrict execution within the upload directory, the attacker can achieve remote code execution (RCE). This allows for full system compromise, including unauthorized access to the database and underlying operating system.
Affected products
- LeptonCMS Project LeptonCMS 7.3.0
Timeline
- 2025-12-09: disclosed: Initial disclosure date
- 2025-12-09: advisory: NVD publication date