CVE-2025-12331
📋 TL;DR
Willow CMS up to version 1.4.0 contains an unrestricted file upload vulnerability in the /admin/images/add endpoint. This allows attackers to upload malicious files to the server, potentially leading to remote code execution. All Willow CMS installations up to version 1.4.0 are affected.
💻 Affected Systems
- Willow CMS
📦 What is this software?
Willow Cms by Matthewdeaves
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
Webshell deployment allowing persistent access, file system manipulation, and potential privilege escalation.
If Mitigated
File uploads blocked or sanitized, limiting impact to denial of service or temporary disruption.
🎯 Exploit Status
Exploit requires admin access to the vulnerable endpoint. Public exploit code is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.4.1 or later
Vendor Advisory: https://github.com/matthewdeaves/willow/issues/132
Restart Required: No
Instructions:
1. Backup current installation. 2. Download Willow CMS version 1.4.1 or later from official repository. 3. Replace affected files with patched version. 4. Verify functionality.
🔧 Temporary Workarounds
Restrict access to /admin/images/add
allBlock or restrict access to the vulnerable endpoint using web server configuration or firewall rules.
# Apache: <Location /admin/images/add> Require all denied </Location>
# Nginx: location /admin/images/add { deny all; }
Implement file upload validation
allAdd server-side validation to restrict file types, extensions, and content.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Willow CMS instances
- Deploy web application firewall with file upload protection rules
🔍 How to Verify
Check if Vulnerable:
Check Willow CMS version in admin panel or configuration files. If version is 1.4.0 or earlier, system is vulnerable.Check Version:
Check config.php or admin panel for version informationVerify Fix Applied:
Verify version is 1.4.1 or later. Test file upload functionality with malicious files to ensure they are rejected.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to /admin/images/add
- Large or suspicious files in upload directories
- Multiple failed upload attempts
Network Indicators:
- POST requests to /admin/images/add with unusual file types
- Traffic patterns indicating file upload exploitation
SIEM Query:
source="web_server" AND (uri="/admin/images/add" AND method="POST") AND (file_extension="php" OR file_extension="jsp" OR file_extension="asp")