CVE-2025-51489: MoonShine Arbitrary File Upload Vulnerability
Summary
CVE-2025-51489: MoonShine Arbitrary File Upload Vulnerability. Affects moonshine/moonshine versions < 3.12.5. Fixed in 3.12.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MoonShine is a popular PHP framework designed for building web applications with a focus on simplicity and efficiency. It provides developers with a robust set of tools and features to create dynamic websites and applications. However, like many web frameworks, it is susceptible to security vulnerabilities, particularly in file handling functionalities.
Vulnerability Detail
An arbitrary file upload vulnerability exists in MoonShine version 3.12.4, allowing attackers to upload crafted SVG files that can execute arbitrary code on the server. This vulnerability arises from insufficient validation of file types and content, leading to potential remote code execution. Attackers can exploit this flaw to gain unauthorized access to sensitive data or take control of the affected server.
How To Fix
Minimum fixed version
3.12.5
This is the first release that contains the fix.
composer require moonshine/moonshine:3.12.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict file uploads to only allow specific file types and implement additional validation checks on the server-side to prevent the execution of malicious files. For example, you can modify your file upload handling code to check the MIME type and file extension before processing the upload.
Conclusion
The arbitrary file upload vulnerability in MoonShine poses a significant risk to applications using version 3.12.4. It is crucial for developers to update to version 3.12.5 or later to mitigate this risk. Implementing additional security measures can further protect applications from potential exploitation.
See every vulnerability recorded for moonshine/moonshine →
FAQ
CVE-2025-51489 is a security vulnerability in MoonShine that allows arbitrary file uploads, potentially leading to remote code execution.
The vulnerability affects MoonShine version 3.12.4. It is fixed in version 3.12.5.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If you cannot update right away, implement strict file type validation and limit file uploads to safe formats as a temporary measure.
The CVSS score of this vulnerability is 4.5, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for moonshine/moonshine.
