PAD CMS has nine critical unpatched remote code execution flaws
CERT Polska disclosed 9 vulnerabilities in end-of-life PAD CMS software, including critical unauthenticated RCE flaws via unrestricted file upload with no patches available.
Sourcecert.pl — open the original
What to check
- Applies to
- The 9 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated the disclosure of nine vulnerabilities affecting PAD CMS, a content management system that has reached end-of-life status and will not receive security patches. The most severe vulnerabilities (CVE-2025-7063, CVE-2025-7065, CVE-2025-8120) allow unauthenticated remote attackers to achieve Remote Code Execution through unrestricted file upload functionality due to client-controlled permission checks. These flaws enable attackers to upload and execute arbitrary files without authentication.
Additional vulnerabilities discovered during CERT Polska's research include Reflected XSS in print/PDF functionality (CVE-2025-8116), improper password recovery initialization allowing account takeover (CVE-2025-8117), client-side brute-force protection bypass (CVE-2025-8118), CSRF in password reset (CVE-2025-8119), and Blind SQL Injection in article positioning (CVE-2025-8121, CVE-2025-8122). These issues affect all three PAD CMS templates: www, bip, and www+bip.
Given the end-of-life status and absence of available patches, organizations running PAD CMS face significant risk and should immediately migrate to alternative platforms. The combination of unauthenticated RCE and multiple authentication bypass mechanisms makes this software critically insecure for continued use.
Mentioned in this report
Detection guidance
Web Server Process Spawning Command Shell (Possible Webshell Execution)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a web server or PHP process spawning a command interpreter, consistent with post-exploitation webshell execution following unrestricted file upload RCE in PAD CMS. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Spawning Command Shell
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \\php-cgi.exe
- \\php.exe
- \\httpd.exe
- \\apache.exe
- \\nginx.exe
- \\w3wp.exe
selection_child:
Image|endswith:
- \\cmd.exe
- \\powershell.exe
- \\pwsh.exe
- \\cscript.exe
- \\wscript.exe
- \\bash.exe
- \\sh.exe
condition: selection_parent and selection_child
falsepositives:
- Legitimate CGI or server-side scripts that intentionally invoke system utilities
as part of normal application functionality
- Administrative scripts triggered through a web management console
level: high
tags:
- attack.t1505.003
- attack.t1190
id: 31db7801-5a1e-56e1-9408-2a440a89e7b6
status: experimental
author: Vorant
Script File Written to Web Upload Directory (Unrestricted File Upload)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects creation of executable script files (php/jsp/asp/aspx) in commonly writable web upload or image directories, indicative of exploitation of unrestricted file upload vulnerabilities such as those in PAD CMS. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Script File Dropped in Web Upload Directory
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains:
- \\uploads\\
- \\images\\
- \\media\\
- \\files\\
TargetFilename|endswith:
- .php
- .phtml
- .jsp
- .asp
- .aspx
filter:
TargetFilename|contains:
- \\vendor\\
- \\node_modules\\
condition: selection and not filter
falsepositives:
- Legitimate CMS plugin or template installation that writes script files into media
directories
- Developer deployment of application code directly into upload folders
level: medium
tags:
- attack.t1190
- attack.t1505.003
id: 3aab120c-57cb-55b1-8195-d94b719d3802
status: experimental
author: Vorant
Command Execution Following Web Process with Suspicious Web Shell Command Patterns
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects command-line execution launched by web server processes containing typical webshell reconnaissance or system commands, suggesting successful exploitation of an unauthenticated RCE (e.g. via unrestricted file upload) and subsequent interactive command execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Command Execution From Web Server Context
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \\php-cgi.exe
- \\php.exe
- \\httpd.exe
- \\nginx.exe
- \\w3wp.exe
selection_cmd:
CommandLine|contains:
- whoami
- net user
- systeminfo
- ipconfig
- tasklist
- certutil
- 'curl '
- 'wget '
condition: selection_parent and selection_cmd
falsepositives:
- Legitimate diagnostic scripts triggered by administrators through a web-based management
interface
level: high
tags:
- attack.t1059
- attack.t1190
- attack.t1203
id: 1f99e9ea-9221-5145-a321-acbff9bcc0f2
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2025/09/CVE-2025-7063
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs