CVE-2025-22213

7.1 highEPSS 0.5%

High (7.1). EPSS 0.5% chance of exploitation in the next 30 days.

Inadequate checks in the Media Manager allowed users with "edit" privileges to change file extension to arbitrary extension, including .php and other potentially executable extensions.

Severity

CVSS 4.0

7.1 high

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/AU:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 42% of CVEs (scores of 2026-10-31)
CWE: CWE-434
Published: 2025-03-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://developer.joomla.org/security-centre/961-20250301-core-malicious-file-uploads-via-media-managere-malicious-file-uploads-via-media-manager.html

Check your stack JSON