# Raytha CMS patched for 11 vulnerabilities Published: 2026-03-16 · Severity: high Canonical: https://vorant.io/reports/5a41eb81-438d-5e08-8f4c-4c325a477e5e/raytha-cms-patched-for-11-vulnerabilities > CERT Polska coordinated disclosure of 11 vulnerabilities in Raytha CMS, including RCE via unsandboxed code execution, multiple XSS flaws, CSRF, SSRF, and account takeover via header spoofing. CERT Polska has coordinated the disclosure of 11 vulnerabilities in Raytha CMS, an open-source content management system. The most severe flaw (CVE-2025-15540) allows privileged users to execute arbitrary .NET code through the "Functions" module due to lack of sandboxing, effectively enabling remote code execution within the application's hosting environment. Additional critical issues include an authentication bypass via Host header poisoning (CVE-2025-69240) that enables account takeover through password reset token capture, and SSRF in the theme import feature (CVE-2025-69239). The vulnerability set also includes seven stored and reflected XSS flaws affecting post editing, page creation, profile fields, and URL parameters (CVE-2025-69236, CVE-2025-69237, CVE-2025-69241, CVE-2025-69242, CVE-2025-69245), along with CSRF across multiple endpoints (CVE-2025-69238). Authentication weaknesses include user enumeration in password reset (CVE-2025-69243) and complete absence of brute force protections (CVE-2025-69246). The vulnerabilities were discovered by security researchers Daniel Basta and Patryk Kieszek. Most issues were patched in version 1.4.6, while the user enumeration flaw was addressed in version 1.5.0. Organizations running Raytha CMS should upgrade immediately to the latest patched version. ## Mentioned in this report - Vulnerabilities: CVE-2025-15540, CVE-2025-69236, CVE-2025-69237, CVE-2025-69238, CVE-2025-69239, CVE-2025-69240, CVE-2025-69241, CVE-2025-69242, CVE-2025-69243, CVE-2025-69245, CVE-2025-69246 ## Detection guidance (public sample) ### Suspicious Child Process Spawned by Web Application Process (Possible Raytha Functions RCE) ATT&CK: T1190 Detects a shell or scripting interpreter spawned by a .NET web server process, consistent with exploitation of the unsandboxed Raytha CMS Functions module (CVE-2025-15540) to execute arbitrary code. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates. ```yaml title: Shell Spawned by .NET Web Process Indicating Possible RCE id: c74e28ba-b3cd-51ac-8f94-81c43623bd74 status: experimental description: Detects cmd, powershell, or bash processes spawned by IIS/ASP.NET worker or dotnet host processes, which may indicate exploitation of an application-layer code execution vulnerability such as the unsandboxed Functions module in Raytha CMS (CVE-2025-15540). references: - https://cert.pl logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \\w3wp.exe - \\dotnet.exe selection_child: Image|endswith: - \\cmd.exe - \\powershell.exe - \\pwsh.exe - \\bash.exe - \\wsl.exe filter_common_admin: CommandLine|contains: - iisreset - dotnet-diagnostics condition: selection_parent and selection_child and not filter_common_admin falsepositives: - Legitimate admin scripts or health-check tooling invoked from IIS application pool identity - Diagnostic or monitoring agents that spawn shells from the web worker process level: high tags: - attack.t1190 - attack.t1059 author: Vorant ``` ### Password Reset Request with Mismatched or Non-Standard Host Header ATT&CK: T1190 Detects HTTP requests to password reset or authentication endpoints where the Host header appears manipulated (raw IP, unexpected port, or value differing from the site's canonical hostname), consistent with Host header poisoning used to hijack password reset tokens (CVE-2025-69240). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates. ```yaml title: Password Reset Endpoint Accessed With Anomalous Host Header id: f0137de0-3996-588e-8aa1-e72cecccde0e status: experimental description: Detects requests to password-reset or account-recovery endpoints carrying a Host header that is an IP address or otherwise inconsistent with the expected application hostname, indicating possible Host header poisoning for authentication bypass / token theft. references: - https://cert.pl logsource: category: webserver detection: selection_path: cs-uri-stem|contains: - /reset-password - /forgot-password - /password-reset selection_bad_host: cs-host|re: ^(\\d{1,3}\\.){3}\\d{1,3}(:\\d+)?$ condition: selection_path and selection_bad_host falsepositives: - Internal health checks or load balancer probes hitting the reset endpoint directly by IP - Development/staging environments accessed via raw IP addresses level: medium tags: - attack.t1190 - attack.t1589.001 author: Vorant ``` ### Automated Tooling Brute Forcing Raytha CMS Login Endpoint ATT&CK: T1110 Detects authentication requests to the login endpoint originating from scripting/automation user agents (curl, python-requests, etc.) without protection, indicative of brute-force credential guessing against an application lacking rate limiting (CVE-2025-69246). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates. ```yaml title: Automated Client Brute Forcing CMS Login Endpoint id: c74fd061-3e4b-578a-8187-737c9ae65f77 status: experimental description: Detects POST requests to a login or authentication endpoint made using common scripting/automation HTTP clients, a pattern consistent with automated brute-force attempts against applications without brute-force protections. Analysts should correlate with a high volume of such requests from the same source in a short window, as Raytha CMS lacked rate-limiting controls (CVE-2025-69246). references: - https://cert.pl logsource: category: webserver detection: selection_login: cs-method: POST cs-uri-stem|contains: - /login - /account/login - /signin selection_ua: cs-user-agent|contains: - curl - python-requests - Go-http-client - libwww-perl condition: selection_login and selection_ua falsepositives: - Internal synthetic monitoring or uptime checks authenticating with scripted clients - QA/automated test suites exercising the login form using scripting HTTP libraries level: medium tags: - attack.t1110 - attack.t1190 author: Vorant ``` Behavioural rules are generated from public reporting — validate in your environment before deploying. Source reporting: https://cert.pl/en/posts/2026/03/CVE-2025-69236 --- This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/5a41eb81-438d-5e08-8f4c-4c325a477e5e/raytha-cms-patched-for-11-vulnerabilities. Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup