CVE-2023-51154 is a critical severity (CVSS 9.8) arbitrary file download flaw in Jizhicms 2.5, in the admin PluginsController. The record names no fixed version, so check the project's issue tracker and releases, and restrict access to the admin paths meanwhile.
What's affected
The NVD description says Jizhicms v2.5 contains an arbitrary file download vulnerability via the component /admin/c/PluginsController.php. The only reference is an issue on the project's Gitee page, which I did not load.
The record lists CWE-200 and names no fixed release. The vector scores confidentiality, integrity and availability all as high, which is unusual for a file download flaw, so read the project's issue for the exact impact.
CVSS for this entry is 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
How to check if you're exposed
Check the installed version in the Jizhicms admin panel or its version file. Version 2.5 matches the record.
Look at web server logs for requests to /admin/c/PluginsController.php from unfamiliar addresses, and check whether the admin path is exposed to the internet.
What to do now
- Confirm whether you run Jizhicms 2.5.
- Follow the project's issue tracker for a fixed release and upgrade when one exists.
- Block public access to the /admin path using your web server or a firewall, allowing only trusted addresses.
- Review logs for the plugins controller and rotate database and admin credentials if you see suspicious downloads.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan against your manifests, and look the entry up in the Safeguard Gold directory to see how it is tracked.
Why it matters
CWE-200 is exposure of sensitive information to an unauthorized actor. The application returns data to someone who should not see it. The fix is to add authorization checks to the code that serves the data.
CWE-200 is exposure of sensitive information. A file download feature that does not restrict which files it serves can hand out configuration, source and credentials. Configuration files in CMS installs often hold database passwords, so one leaked file can lead to wider compromise.
The record does not report exploitation.
The record does not mark this CVE as listed in the CISA Known Exploited Vulnerabilities catalog, and no source I read reports exploitation in the wild.
Quick check
Does it need a login?
The NVD vector says no privileges are required.
Is there a patch?
The record names none. Check the project's repository.
Sources
Last reviewed: 19 October 2026.
