CVE-2025-22213 | THREATINT

Description

Inadequate checks in the Media Manager allowed users with "edit" privileges to change file extension to arbitrary extension, including .php and other potentially executable extensions.

Reserved 2025-01-01 | Published 2025-03-11 | Updated 2025-03-11 | Assigner Joomla

HIGH: 7.1CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/AU:N

Problem types

CWE-434 Unrestricted Upload of File with Dangerous Type

Product status

Default status

unaffected

4.0.0-4.4.11

affected

5.0.0-5.2.4

affected

Credits

ErPaciocco finder

References

developer.joomla.org/...-file-uploads-via-media-manager.html vendor-advisory

cve.org (CVE-2025-22213)

nvd.nist.gov (CVE-2025-22213)

Download JSON