Quick answers
- Is CVE-2025-60730 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-60730 being exploited in the wild.
- How severe is CVE-2025-60730?
- High severity, with a CVSS score of 7.6, published 24 October 2025.
- Which products and versions are affected?
- Perfreeblog 4.0.11.
- Is there a fix for CVE-2025-60730?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2025-60730 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2025-60730?
- Check whether you run Perfreeblog at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An arbitrary file deletion vulnerability exists in PerfreeBlog v4.0.11 within the `unInstallTheme` function. The application fails to properly validate or sanitize the `themePath` parameter before using it in file system operations. By supplying directory traversal sequences (e.g., `../../`), a remote attacker can escape the intended theme directory and delete arbitrary files on the host server. While the CVSS vector suggests some user interaction (UI:R), the technical report indicates the vulnerability is reachable via a direct API request to `/api/auth/theme/unInstallTheme`. Successful exploitation can lead to data loss or denial of service by deleting critical application or system files.
Affected products
- Perfree PerfreeBlog 4.0.11
Timeline
- 2025-10-24: advisory: NVD published the CVE record.