CVE-2025-4291 is a medium severity (CVSS 6.3) unrestricted file upload in IdeaCMS up to version 1.6. The saveUpload function accepts files it should reject, and the attack can start remotely. The record names no fixed version, so restrict uploads at the web server and check the project's issue tracker.
What's affected
IdeaCMS up to and including 1.6, per the record. The weak point is the saveUpload function. The record says the manipulation leads to unrestricted upload and that the attack can be launched remotely.
The weaknesses are tagged CWE-434, unrestricted upload of a file with a dangerous type, and CWE-284, improper access control. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, so the scoring assumes the attacker holds a low privilege account. The record does not list a fixed version. The only reference from the project is an issue on its Gitee tracker, and I could not read it, so check it directly for any patch or discussion.
How to check if you're exposed
Find out whether you run IdeaCMS, and which version. Look at the application's version file or admin footer, and compare it with 1.6.
Then look at what your upload directory contains. Files that do not belong, such as scripts in a folder meant for images, are a warning sign.
find /var/www/path/to/uploads -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" \) 2>/dev/null
Review the web server access logs for POST requests to the upload endpoint, and for later requests to files in the upload directory that end in a script extension. Any hit deserves a closer look.
What to do now
- Inventory IdeaCMS installs and record their versions.
- Block script execution in the upload directory at the web server, so a stray file there is served as data or refused.
- Allow only the file types your site really needs, and check type and content on the server, not only the extension.
- Require authentication for the upload endpoint if it is not already protected.
- Search upload folders for files that should not be there and remove them after saving copies for review.
- Watch the project's issue tracker for a fix, and plan a move to a maintained system if none appears.
Why it matters
Upload handlers are a common source of serious bugs. If a site stores a file that the server later runs as code, a visitor can end up running their own code on your server. The record does not claim that outcome for this CVE, and the score of 6.3 reflects a limited, medium level of impact. But unrestricted upload is the kind of weakness that gets worse with the server's configuration, so it is worth closing early.
The record says an exploit has been disclosed to the public and may be used. It does not flag the CVE as listed in CISA's Known Exploited Vulnerabilities catalog (KEV), so there is no confirmation here of attacks in the wild.
Quick check
Is there a fixed version of IdeaCMS?
The record does not give one. The only project reference is an issue on Gitee. Check it, and treat all versions up to 1.6 as affected until you confirm otherwise.
Why is a medium score still worth fixing?
The score reflects the base metrics, not your setup. If uploaded files can be executed on your server, the real impact can be much higher than the number suggests.
Sources
- Gold entry for CVE-2025-4291
- Gold entry for CWE-434
- IdeaCMS issue on Gitee, listed in the CVE record
- VulDB entry, listed in the CVE record
The reference pages above are linked from the CVE record and block or limit automated access, so I could not read their full text.
Last reviewed: 18 October 2026.
