CVE-2025-6735: JuzaWeb CMS 3.4.2 Vulnerable to Improper Authorization in Import Page Component
Summary
CVE-2025-6735: JuzaWeb CMS is vulnerable to Incorrect Privilege Assignment when installing Import Page component. Affects juzaweb/cms versions < 3.4.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
JuzaWeb CMS is an open-source content management system designed for building and managing websites. It offers a range of features including customizable themes, plugins, and an intuitive admin interface. However, version 3.4.2 has been identified with a critical vulnerability that affects the Import Page component, allowing unauthorized access to sensitive functionalities.
Vulnerability Detail
A vulnerability classified as critical has been discovered in JuzaWeb CMS version 3.4.2. The issue arises from improper authorization in the Import Page component located in the /admin-cp/imports file. This flaw allows attackers to exploit the system remotely, potentially leading to unauthorized actions being performed without proper permissions. The vulnerability has been publicly disclosed, and the vendor has not responded to the notification regarding this issue.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, restrict access to the /admin-cp/imports directory by implementing server-level access controls or by disabling the Import Page functionality until the patch is applied.
Conclusion
In summary, JuzaWeb CMS version 3.4.2 is vulnerable to a critical issue related to improper authorization in the Import Page component. Users are advised to update their installations promptly to mitigate the risk of exploitation. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for juzaweb/cms →
FAQ
CVE-2025-6735 is a critical vulnerability in JuzaWeb CMS 3.4.2 that allows improper authorization in the Import Page component.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to unauthorized access and manipulation of the CMS, potentially compromising sensitive data and functionalities.
Yes, updating to the latest version of JuzaWeb CMS will address this vulnerability. Use 'composer update juzaweb/cms' to apply the patch.
The CVSS score for this vulnerability is 6.3, indicating a moderate level of risk.
Related vulnerabilities
Recent vulnerabilities recorded for juzaweb/cms.
