GCVE - cpe:2.3:a:1000mz:chestnutcms:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:1000mz:chestnutcms:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	1000Mz (`167c91fb-80a3-5255-98c5-8d627801c667`)
Product	Chestnutcms (`73cac130-a650-586d-940a-79d803db718e`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/liweiyi/chestnutcms`	purl2cpe	2026-06-01 10:16:26.815115

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-70073`	vulnerable	2026-06-08 07:43:16.872751	Details available An issue in ChestnutCMS v.1.5.8 and before allows a remote attacker to execute arbitrary code via the template creation function Published: 2026-02-05T00:00:00.000Z Updated: 2026-02-09T14:53:39.778Z Open on db.gcve.eu Reference links https://github.com/liweiyi/ChestnutCMS/issues/8	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-2917`	vulnerable	2026-06-08 07:16:58.673751	ChestnutCMS read readFile path traversal MEDIUM (4.3) A vulnerability, which was classified as problematic, was found in ChestnutCMS up to 1.5.3. Affected is the function readFile of the file /dev-api/cms/file/read. The manipulation of the argument filePath leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Published: 2025-03-28T17:31:04.433Z Updated: 2025-03-28T17:43:16.861Z Open on db.gcve.eu Reference links https://vuldb.com/?id.301890 https://vuldb.com/?ctiid.301890 https://vuldb.com/?submit.520933 https://r0ot.notion.site/ChestnutCMS-1-5-3-Arbitrary-file-read-vulnerability-1ae27d744f7f8074a169ca849e8a1d31?pvs=4	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-15009`	vulnerable	2026-06-08 07:06:35.525194	liweiyi ChestnutCMS Filename upload FilenameUtils.getExtension unrestricted upload MEDIUM (6.3) A flaw has been found in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function FilenameUtils.getExtension of the file /dev-api/common/upload of the component Filename Handler. Executing manipulation of the argument File can lead to unrestricted upload. The attack may be launched remotely. The exploit has been published and may be used. Published: 2025-12-22T02:32:05.919Z Updated: 2025-12-22T14:35:21.606Z Open on db.gcve.eu Reference links https://vuldb.com/?id.337715 https://vuldb.com/?ctiid.337715 https://vuldb.com/?submit.719590 https://github.com/yuccun/CVE/blob/main/ChestnutCMS-Arbitrary_File_Upload.md https://github.com/yuccun/CVE/blob/main/ChestnutCMS-Arbitrary_File_Upload.md#vulnerability-proof	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-12923`	vulnerable	2026-06-08 07:04:31.209615	liweiyi ChestnutCMS download resourceDownload path traversal LOW (2.7) A vulnerability was determined in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function resourceDownload of the file /dev-api/common/download. Executing manipulation of the argument path can lead to path traversal. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Published: 2025-11-10T00:32:06.381Z Updated: 2025-11-10T17:16:15.308Z Open on db.gcve.eu Reference links https://vuldb.com/?id.331643 https://vuldb.com/?ctiid.331643 https://vuldb.com/?submit.681032 https://github.com/Huu1j/CVE/blob/main/chestnutcms%20Arbitrary%20File%20Read.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-57452`	vulnerable	2026-06-08 06:56:13.537304	Details available ChestnutCMS <=1.5.0 has an arbitrary file deletion vulnerability in contentcore.controller.FileController, which allows attackers to delete any file and folder. Published: 2025-02-03T00:00:00.000Z Updated: 2025-02-04T20:02:50.780Z Open on db.gcve.eu Reference links https://locrian-lightning-dc7.notion.site/File-Delete-1628e5e2b1a280cfb497de7b8bcff128	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-57451`	vulnerable	2026-06-08 06:56:13.537010	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-57450`	vulnerable	2026-06-08 06:56:13.536511	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-56828`	vulnerable	2026-06-08 06:56:13.211039	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.