CVE-2025-8120

The permission verification mechanism in the photo upload function relies on a client-controlled parameter, allowing arbitrary modification. An attacker without any authentication can send a crafted request with an executable file (e.g., webshell) and bypass all restrictions on allowed file types and extensions. After uploading, the malicious file can be invoked by the attacker, resulting in code execution on the server. The issue affects all three system templates: www, bip, and ww+bip.

An attacker gains the ability to execute arbitrary code on the server (RCE) without needing any permissions, which may lead to complete system takeover, data breach, and further lateral movement in the infrastructure.

The vendor will not publish fixes for this vulnerability — the product has reached End-Of-Life status. Immediately withdraw PAD CMS from use or isolate it from the public network (e.g., disable external access, apply firewall rules blocking access to upload functions). Migration to an actively supported CMS solution is recommended. Additional references: https://cert.pl/posts/2025/09/CVE-2025-7063

All versions of Widzialni PAD CMS in all three templates: www, bip, and ww+bip. The product is marked as End-Of-Life.