CVE-2025-9406

2.1 lowEPSS 0.4%

A weakness has been identified in xuhuisheng lemon up to 1.13.0. This affects the function uploadImage of the file CmsArticleController.java of the component com.mossle.cms.web.CmsArticleController.uploadImage. This manipulation of the argument Upload causes unrestricted upload. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited.

Severity

CVSS 4.0

2.1 low

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 33% of CVEs (scores of 2026-10-31)
CWEs: CWE-434, CWE-284
Published: 2025-08-25
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

mossle:lemon

References

https://github.com/xuhuisheng/lemon/issues/212
https://github.com/xuhuisheng/lemon/issues/212#issue-3317490086
https://vuldb.com/?ctiid.321242
https://vuldb.com/?id.321242
https://vuldb.com/?submit.633593

Check your stack JSON