CVE-2025-67164: Pagekit CMS Arbitrary File Upload Vulnerability Leading to OS Command Injection
Summary
CVE-2025-67164: Pagekit CMS is vulnerable to OS Command Injection via Storage component. Affects pagekit/pagekit versions < 1.0.18. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pagekit CMS is a modular and lightweight content management system designed for building websites and applications. It offers a user-friendly interface, customizable themes, and a variety of extensions to enhance functionality. However, a critical vulnerability has been identified in its storage component, which allows for unauthorized file uploads, potentially leading to severe security breaches.
Vulnerability Detail
An authenticated arbitrary file upload vulnerability exists in the /storage/poc.php component of Pagekit CMS v1.0.18. This flaw allows attackers to upload crafted PHP files, which can then be executed on the server, leading to arbitrary code execution. The vulnerability arises from insufficient validation of uploaded files, enabling attackers to exploit the system and execute malicious commands. The ramifications of this vulnerability are severe, as it can lead to complete server compromise, data loss, and unauthorized access to sensitive information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can restrict file uploads by modifying the server configuration to disallow PHP file uploads or by implementing stricter validation checks on the file types being uploaded. Additionally, consider removing the /storage/poc.php file if it is not essential for your application.
Conclusion
The CVE-2025-67164 vulnerability in Pagekit CMS poses a critical risk due to its ability to allow arbitrary file uploads, leading to OS command injection. Users are strongly advised to update to a patched version or migrate to a different CMS to mitigate this risk. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for pagekit/pagekit →
FAQ
CVE-2025-67164 is a vulnerability in Pagekit CMS that allows for arbitrary file uploads, leading to potential OS command injection.
If you are using Pagekit CMS version 1.0.18 or earlier, your installation is vulnerable. You can check your application's composer.lock file using Vulert to see if it is affected.
The risks include unauthorized access to the server, execution of arbitrary code, data loss, and potential compromise of sensitive information.
No official patch is available since Pagekit CMS has been archived. It is recommended to migrate to a different CMS.
Vulert uses your composer.lock file to monitor and alert you in real-time about open-source vulnerabilities in your software, ensuring you stay informed about potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for pagekit/pagekit.
