CVE-2025-58449: Maho Package Vulnerable to Authenticated Remote Code Execution via File Upload
Summary
CVE-2025-58449: Maho is Vulnerable to Authenticated Remote Code Execution via File Upload. Affects mahocommerce/maho versions < 25.9.0. Fixed in 25.9.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Maho is an open-source e-commerce platform that allows users to manage products, orders, and customer data. It provides a user-friendly dashboard for staff users to handle various aspects of the online store. However, a vulnerability exists in version 25.7.0 that allows authenticated users with specific permissions to upload malicious files, leading to potential remote code execution.
Vulnerability Detail
In Maho version 25.7.0, an authenticated staff user with access to the Dashboard and Catalog\Manage Products permissions can create a custom option with a file input field. By allowing file uploads with a .php extension, the user can upload malicious PHP files, leading to remote code execution. This vulnerability arises from the ability to define an extension whitelist for file uploads, bypassing the application's normal restrictions. The uploaded files are stored in a predictable location within the webroot, making them accessible via HTTP, thus allowing an attacker to execute arbitrary PHP code.
How To Fix
Minimum fixed version
25.9.0
This is the first release that contains the fix.
composer require mahocommerce/maho:25.9.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict the permissions of users who can access the Dashboard and Catalog\Manage Products features. Ensure that only trusted users have the ability to create custom options with file uploads.
Conclusion
The CVE-2025-58449 vulnerability in the Maho package poses a significant risk by allowing authenticated users to upload malicious files, leading to remote code execution. It is crucial to update to version 25.9.0 or later to mitigate this risk. Additionally, consider implementing user permission restrictions as a temporary workaround.
See every vulnerability recorded for mahocommerce/maho →
FAQ
CVE-2025-58449 is a vulnerability in the Maho package that allows authenticated users to upload malicious PHP files, leading to remote code execution.
Any installation of the Maho package version 25.7.0 that allows authenticated users with specific permissions to create custom file upload options is affected.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package, consider restricting user permissions to limit access to the vulnerable features as a temporary measure.
The vulnerability allows attackers to execute arbitrary PHP code on the server, which can lead to data breaches, server compromise, and further exploitation of the application.
