CVE-2025-1177 is a medium severity unsafe deserialization flaw (CVSS 6.3) in dayrui XunRuiCMS version 4.6.3. The import_add function in the admin Linkage controller deserialises data it should not trust. The record lists no fixed version, so check the vendor release notes and limit admin access.
What's affected
dayrui XunRuiCMS version 4.6.3 is named in the record. The weakness is in the import_add function of dayrui/Fcms/Control/Admin/Linkage.php, an administrative controller. It is classified as CWE-20 (Improper Input Validation) and CWE-502 (Deserialization of Untrusted Data).
The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. The attack runs over the network, needs low complexity, and needs a low privilege account. The record adds that the exploit has been disclosed to the public and may be used.
The record names no fixed version and links a single public write-up rather than a vendor advisory. Check the XunRuiCMS release notes for anything newer than 4.6.3 before you assume you are covered.
How to check if you're exposed
Find out which version each site runs. In the admin panel, look at the about or system page. On the server, search the application folder for the affected controller:
find /var/www -path "*dayrui/Fcms/Control/Admin/Linkage.php" 2>/dev/null
grep -n "unserialize" /var/www/*/dayrui/Fcms/Control/Admin/Linkage.php
If the file exists and the import code calls an unserialize style function on request data, the install matches the description. Then list who holds admin accounts, because the record shows a low privilege requirement. Review admin login history and recent import actions for anything you did not do.
What to do now
-
Confirm the XunRuiCMS version on every site, and plan an upgrade to a release the vendor names as fixed if one exists.
-
Restrict the admin path to a VPN or an allowlist.
-
Audit admin accounts, remove any that are unused, and enforce strong unique passwords.
-
Disable or avoid the linkage import feature until the code is fixed or patched.
-
Take a backup of files and database before any change, and keep it offline.
-
Review recent file changes in the web root and the admin audit log.
Why it matters
Deserialization bugs turn stored or submitted data into live objects. When the code that rebuilds those objects trusts its input, the data can steer what the program does next. The record files this under CWE-20 (Improper Input Validation) and CWE-502 (Deserialization of Untrusted Data).
The usual fix is to stop deserialising untrusted input, use a plain data format such as JSON with strict validation, or restrict which classes may be rebuilt. For a content management system, the admin interface is a high value target, so even a flaw that needs a login deserves attention.
The record does not mark the CVE as exploited in the CISA Known Exploited Vulnerabilities catalog, but it does say the exploit is public.
To see whether a vulnerable package is hiding in your own projects, run the free in-browser dependency scan at gold.safeguard.sh/scan. The Gold directory lists the same advisories alongside affected versions, and reachability analysis helps you rank which findings are actually called by your code.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this need an account?
The vector in the record shows a low privilege requirement, so an attacker needs some login. Treat any exposed admin panel as a risk until access is restricted.
What is deserialization in plain terms?
It is the step where a program turns stored or sent data back into live objects. If the data is not trusted, an attacker can influence what those objects do.
Sources
Last reviewed: 19 October 2026.
