CVE-2025-7065

The photo upload function in PAD CMS relies on a client-side controlled parameter that is responsible for verifying file upload permissions. An attacker can modify this parameter, completely bypassing the permission checking mechanism. As a result, it is possible to upload a file of any type and extension (e.g., webshell script) without any restrictions or authentication requirements. The uploaded file can then be executed on the server, leading to Remote Code Execution.

An attacker gains the ability to execute arbitrary code remotely on the server (RCE), which can lead to complete system compromise, data breach, installation of backdoors, or further lateral movement within the organization's network.

The manufacturer will not release a patch – the product is in End-Of-Life status. It is recommended to immediately disable or isolate PAD CMS instances from the public network, migrate to an alternative supported solution, and implement access control mechanisms at the infrastructure level (e.g., firewall, WAF). Details available in references: https://cert.pl/posts/2025/09/CVE-2025-7063

All versions of PAD CMS by Widzialni in all three templates: www, bip, and ww+bip.