CVE-2025-5499: High Deserialization in phpwcms

CVE-2025-5499 is a high severity deserialization flaw in phpwcms, an open source PHP content management system. The imgfile argument of image_resized.php reaches file handling functions in versions up to 1.9.45 and 1.10.8, with no login required. Upgrading to 1.9.46 or 1.10.9 resolves it.

What's affected

• Product: phpwcms, by slackero.
• Affected: up to 1.9.45 on the legacy branch, and up to 1.10.8 on the current branch.
• Fixed: 1.9.46 and 1.10.9.
• Component: image_resized.php, in the handling of is_file and getimagesize with the imgfile argument.
• Authentication: the vector shows no privileges required, which makes this more exposed than the sister issue CVE-2025-5497 that needs an account.

The 1.10.9 release page describes a maintenance release, and says that installs older than 1.10 should move to the legacy 1.9.46 release first. Follow that order if you are on an old version.

How to check if you're exposed

Find the version in the phpwcms backend or the installation files, and compare with 1.9.46 and 1.10.9.

For a public site, also check the web server logs for requests to the image_resized.php file with unusual values in the file argument, and see whether they come from addresses you do not expect.

Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that checks a manifest or lockfile against known vulnerabilities, and the Gold directory lists affected packages for each CVE.

What to do now

1. Find every phpwcms installation, including staging and abandoned sites.
2. Upgrade to 1.10.9, or to 1.9.46 on the legacy branch.
3. Because no login is needed to reach the file, treat unpatched public sites as the first priority.
4. Check the web server logs for unusual requests to the image script, and review the upload directories for files you did not add.
5. Consider blocking direct access to helper scripts at the web server where the site design allows it.

Why it matters

The record classes this as improper input validation and deserialization of untrusted data. In PHP, some file functions can read archive-like content and, in the process, restore objects from it. If an attacker controls which file or path the function sees, that behavior can be steered. The fix is to validate the value strictly, accept only expected local files, and avoid passing user input to such functions.

The lesson for site owners is that small helper scripts, such as image resizers, need the same scrutiny as login pages. They are public, they take input from the URL, and they often run with the web server's full file permissions. It is not on the CISA KEV list.

The weakness is classed as CWE-20 (Improper Input Validation) and CWE-502 (Deserialization of Untrusted Data). Severity in the CVE record: high, CVSS 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).

Quick check

Sources

• phpwcms 1.10.9 release page
• Researcher write-up on GitHub (listed in the CVE record, not fetched)
• VulDB entry 310914 (listed in the CVE record, not fetched)

Last reviewed: 18 October 2026.