CVE-2025-60790: ProcessWire CMS Resource-Exhaustion Denial of Service Vulnerability
Summary
CVE-2025-60790: ProcessWire CMS vulnerable to resource-exhaustion Denial of Service. Affects processwire/processwire versions < 3.0.246. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
ProcessWire is an open-source content management system (CMS) and framework designed for building websites and applications. It is known for its flexibility, user-friendly interface, and powerful API, allowing developers to create custom solutions. However, a vulnerability has been identified in version 3.0.246 that affects low-privileged users with lang-edit permissions, enabling them to exploit the system.
Vulnerability Detail
The vulnerability in ProcessWire CMS 3.0.246 allows a low-privileged user with lang-edit permissions to upload a specially crafted ZIP file to the Language Support feature. This ZIP file is auto-extracted without proper validation, leading to resource exhaustion and potential Denial of Service (DoS). The lack of limits on the extraction process can overwhelm the server, causing it to become unresponsive.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, restrict the permissions of low-privileged users to prevent them from accessing the Language Support feature until the package is updated. Additionally, consider implementing file upload validation to limit the types and sizes of files that can be uploaded.
Conclusion
The vulnerability CVE-2025-60790 in ProcessWire CMS poses a significant risk by allowing low-privileged users to exploit the system through crafted ZIP uploads. It is crucial to update to the latest version to safeguard against potential Denial of Service attacks.
See every vulnerability recorded for processwire/processwire →
FAQ
CVE-2025-60790 is a vulnerability in ProcessWire CMS that allows low-privileged users to exploit the system by uploading crafted ZIP files, leading to resource exhaustion and Denial of Service.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
If you cannot update immediately, restrict access to the Language Support feature for low-privileged users and implement file upload validation as a temporary measure.
The vulnerability can lead to resource exhaustion, causing the server to become unresponsive, which can disrupt services and affect user experience.
Yes, a patch is available. Update ProcessWire to a version higher than 3.0.246 to mitigate the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for processwire/processwire.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
