CVE-2025-7063

The permission verification mechanism during file uploads is controlled on the client side, meaning an attacker can modify the parameter responsible for permission verification and bypass all restrictions. As a result, it is possible to upload a file of any extension — including executable scripts — without needing any account in the system. After uploading such a file, the attacker can trigger its execution on the server, gaining remote control over the system (RCE). The problem affects all three system templates: www, bip, and ww+bip.

An unauthenticated attacker can gain full remote control over the server (RCE), including the ability to execute arbitrary commands, steal data, and perform lateral movement within the internal network.

The vendor will not publish patches for this vulnerability due to the End-Of-Life status of the product. It is recommended to immediately disable or isolate PAD CMS instances from the public network and migrate to an actively supported system. As interim measures, consider blocking access to upload functionality at the firewall or web server level and implementing restrictive access controls to directories containing user-uploaded files.

Widzialni PAD CMS — all three templates: www, bip, and ww+bip. The product is marked as End-Of-Life.