CVE-2025-65474 is a critical (CVSS 9.8) arbitrary file rename flaw in EasyImages 2.0, an image hosting application, version 2.8.6 and below. The admin file manager can rename an uploaded file so it runs as PHP, which leads to code execution. The record names no fix, so limit access and watch for updates.
What's affected
EasyImages 2.0 version 2.8.6 and below, according to the record. The weak component is /admin/manager.php. The record says an attacker can execute arbitrary code by renaming a PHP file to a SVG format. The write-up I fetched shows the reverse direction, where an uploaded file with an image extension is renamed to a PHP extension. Either way, the root issue is that the rename is not restricted.
The record gives CVSS 3.1 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which means no login and no user interaction. The public write-up describes the flow differently. It involves an administrator following a crafted link. The record's vector and the write-up do not match on that point, so consider the risk to be high until you know otherwise.
The record names no fixed version or vendor advisory. I did not find one in the references.
How to check if you're exposed
Find the version of EasyImages 2.0 you run. The version is shown in the admin area, and in the project files. Anything up to 2.8.6 is in scope.
Then look at the upload directory for files that do not belong. Image hosting directories should hold images, so search for script files:
find /path/to/easyimages/i -type f ( -name "*.php" -o -name "*.phtml" -o -name "*.phar" ) 2>/dev/null
Adjust the path to your install. Any hit deserves investigation. Review web server logs for requests to the admin file manager from addresses outside your team.
What to do now
- Check the project's repository for a release newer than 2.8.6, and upgrade if it addresses this.
- Restrict the admin area to a trusted network or VPN.
- Configure the web server so that the upload directory cannot execute scripts. Serve it as static files only.
- Enforce strong admin credentials and remember to log out of the admin area.
- Search for script files in the upload directory and review the server for compromise if you find any.
Why it matters
The record lists CWE-434 (unrestricted upload of a file with a dangerous type) and CWE-706 (use of an incorrectly resolved name or reference). Upload validation usually checks the name at the moment of upload. If a later feature can rename the file, the check is no longer valid. The fix is to apply the same rules at every step, and to stop the web server from executing anything in the upload directory.
Small self-hosted applications like this tend to run without a vendor security team. If there is no patch, configuration is your defense. The record does not say this flaw was exploited in the wild, and the KEV flag is false. The free Safeguard dependency scan can list the packages in a project and flag known CVEs, and the Gold directory keeps a page for each one.
Quick check
Is there a patched version?
The record names none. Check the project repository for a release newer than 2.8.6.
What is the best mitigation if there is no patch?
Block script execution in the upload directory and restrict the admin area. These two steps cut the path to code execution.
Sources
Last reviewed: 18 October 2026.
