High severity · published Oct 28, 2025
CVE-2025-12347
MaxSite CMS save-file-ajax.php unrestricted upload
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
A flaw has been found in MaxSite CMS up to 109. This issue affects some unknown processing of the file application/maxsite/admin/plugins/editor_files/save-file-ajax.php. Executing manipulation of the argument file_path/content can lead to unrestricted upload. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CM
CMS · MaxSite
109 · source: vendor
MC
Maxsite Cms · Max-3000
through 109 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-12347
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-12347
Exploit
https://note-hxlab.wetolink.com/share/lIWZkTHQPSVh
Permissions Required
https://vuldb.com/?ctiid.330137
Third Party Advisory
https://vuldb.com/?id.330137
Third Party Advisory
https://vuldb.com/?submit.674552
More from CMS
9.8
CVE-2026-3395
MaxSite CMS MarkItUp Preview AJAX Endpoint preview-ajax.php eval code injection
8.8
CVE-2025-12346
MaxSite CMS HTTP Header uploads-require-maxsite.php unrestricted upload
2.4
CVE-2026-7016
MaxSite CMS ushki Plugin cross site scripting
2.4
CVE-2026-7015
MaxSite CMS Guestbook Plugin cross site scripting
2.4
CVE-2026-7014
MaxSite CMS down_count Plugin cross site scripting