CVE-2025-65602 is a critical (CVSS 9.8) template injection in ChanCMS version 3.3.4. A crafted POST request to the /vip/v1/file/save component lets an attacker execute arbitrary code. The record names no fixed version, so restrict access to the application, check the project for updates and review the server.
What's affected
ChanCMS 3.3.4 is the version named in the record. The vulnerable component is /vip/v1/file/save. The record says a crafted POST request can lead to arbitrary code execution through template injection.
The record gives CVSS 3.1 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which means network access, no login and no user interaction. The reference for the report is titled as an unauthenticated remote code execution. That page is a document in a note taking service that did not render for me, so I could not confirm details beyond the record.
The record names no fixed version. The only other reference is the project's code repository. Whether versions after 3.3.4 are fixed is not something I could confirm, so check the repository for a newer release and its notes.
How to check if you're exposed
Find the ChanCMS version you run. Look at the project files or the admin console. Version 3.3.4 is in scope, and earlier versions may be as well because the record does not say where the flaw began.
Check whether the application is reachable from the internet, and whether the file save path is reachable without a login. A reverse proxy rule can show you what is exposed. Review web logs for POST requests to the file save path.
Look at the template files and the web root for recent changes you did not make. Unexpected files are a sign that someone has already used the flaw.
What to do now
- Check the project repository for a release after 3.3.4 and read its notes.
- Block the file save path from untrusted networks at the reverse proxy, and require authentication in front of the admin area.
- Run the application as an unprivileged user with write access only to the directories it needs.
- Review templates and web root files for unexpected changes, and compare them with a clean copy.
- If you find signs of compromise, treat the server as untrusted, rotate its secrets and rebuild it.
Why it matters
The record lists CWE-1336 (improper neutralization of special elements used in a template engine) and CWE-94 (code injection). Template engines run expressions. If user input ends up inside a template that is then rendered, the user can run expressions as well. The safe pattern is to pass data into a template as a value and never to build template text from input.
A content management system sits in front of the internet, stores credentials and can change what visitors see. A remote code flaw there is serious even when the product is small. The record does not say this flaw was exploited in the wild, and the KEV flag is false. The free Safeguard dependency scan can list the packages in a project and flag known CVEs, and the Gold directory keeps a page for each one.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a fixed version of ChanCMS?
The record names none. Check the project repository for a release after 3.3.4.
Why is the evidence thin?
The record is short and the main reference did not render. This post sticks to what the record says.
Sources
Last reviewed: 18 October 2026.
