p PatchFirst

CVE-2025-58449

CVE-2025-58449 · Maho Vulnerable to Authenticated Remote Code Execution via File Upload

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Maho is a free and open source ecommerce platform. In Maho prior to 25.9.0, an authenticated staff user with access to the `Dashboard` and `Catalog\Manage Products` permissions can create a custom option on a listing with a file input field. By allowing file uploads with a `.php` extension, the user can use the filed to upload malicious PHP files, gaining remote code execution. Version 25.9.0 fixes the issue.

CVSS 8.7 · High · EPSS 0.3% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • maho

    Versions
    • < 25.9.0: Affected

    No fix published

  • mahocommerce/maho Packagist

    Versions
    • 24.11.0
    • 24.9.0
    • 25.1.0
    • 25.3.0
    • 25.5.0
    • 25.7.0
    Affected ranges
    • ECOSYSTEM: < 25.9.0

    Update to 25.9.0

Original sources

Check your server →