CVE-2025-5497 is a medium severity deserialization flaw in the Feedimport module of phpwcms, an open source PHP content management system. The cnt_text argument in processing.inc.php is handled unsafely in versions up to 1.9.45 and 1.10.8. Upgrading to 1.9.46 or 1.10.9 resolves it.
What's affected
- Product: phpwcms, by slackero.
- Affected: up to 1.9.45 on the legacy branch, and up to 1.10.8 on the current branch.
- Fixed: 1.9.46 and 1.10.9.
- Component: the Feedimport module, file
include/inc_module/mod_feedimport/inc/processing.inc.php. - Patch: commit 41a72eca0baa9d9d0214fec97db2400bc082d2a9, named in the record.
The 1.10.9 release page describes itself as a maintenance release with fixes and smaller changes, and adds that installations older than 1.10 should move to the legacy 1.9.46 release first. If you are on an older branch, follow that order.
The vector requires low privileges, so a user account is needed. A related finding in the same product, CVE-2025-5499, was fixed in the same releases.
How to check if you're exposed
Look for the version in the phpwcms backend, or in the release notes that match your installed files.
If your site uses a Git checkout or a Composer or Docker based install, check the tag or image version instead. Also check whether the Feedimport module is enabled at all. A module that you do not use is still code on disk, so consider removing it.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that checks a manifest or lockfile against known vulnerabilities, and the Gold directory lists affected packages for each CVE.
What to do now
- Find every phpwcms installation, including staging and old sites that were never decommissioned.
- Upgrade to 1.10.9, or to 1.9.46 if you are on the legacy branch.
- If you are on a version older than 1.10, move to 1.9.46 first as the release notes advise, then plan the move to the current branch.
- Disable the Feedimport module if you do not use it, and review which users can reach the backend.
- Back up the site before the upgrade, and test feed import afterwards if you rely on it.
Why it matters
Deserialization turns stored or transmitted data back into objects. When the data is under a user's control, the process can instantiate objects the application never meant to create. PHP applications are particularly exposed when a feature accepts serialized values or reads archive-like files, because the language can trigger behavior during object creation.
The listed classes are improper input validation and deserialization of untrusted data. The remedy is to avoid deserializing user-controlled values, to use a plain data format such as JSON where possible, and to validate inputs before they reach any such call. Patch the application, and treat modules you do not use as attack surface worth removing. It is not on the CISA KEV list.
The weakness is classed as CWE-20 (Improper Input Validation) and CWE-502 (Deserialization of Untrusted Data). Severity in the CVE record: medium, CVSS 6.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
Quick check
Which versions fix it?
1.9.46 on the legacy branch and 1.10.9 on the current branch, according to the record and the project release page.
Does the flaw need a login?
The vector shows low privileges required, so a valid account is needed to attack it.
Sources
- phpwcms 1.10.9 release page
- Fix commit (listed in the CVE record, not fetched)
- VulDB entry 310912 (listed in the CVE record, not fetched)
Last reviewed: 18 October 2026.
