CVE-2025-7063 is a critical (9.8) unrestricted upload flaw in the file upload function of PAD CMS, all versions up to and including 1.2.1. An unauthenticated remote attacker can upload files of any type, which can lead to remote code execution. The product is end of life and no patch will come, so retire or isolate it.
What's affected
- Product: PAD CMS from Polska Akademia Dostepnosci (listed by the record as widzialni pad_cms).
- Versions: all versions up to and including 1.2.1, according to the CERT Polska advisory.
- Templates: all three, named www, bip and ww+bip.
- Fixed version: none. The record states that the product is end of life and the producer will not publish patches.
The record and the CERT Polska advisory agree on the score and the weakness. The record gives 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and the advisory identifies the class as CWE-434. The advisory page does not carry its own CVSS score, so there is no severity disagreement to report. It is not on the CISA KEV list according to the record, and neither source says the flaw has been used in attacks.
The same advisory covers a sibling flaw in the photo upload function, CVE-2025-7065, and several other PAD CMS CVEs published on the same day. If you run PAD CMS, read the whole advisory rather than this one entry.
How to check if you're exposed
PAD CMS is a web application, not a library from a package registry, so check the installation itself.
- Find every PAD CMS instance. Look for the product name in your web server configuration, hosting inventory and any public sector or accessibility sites you manage.
- Identify the version. The advisory covers everything up to and including 1.2.1, so unless you can show a later release, treat the instance as affected.
- Check which template is in use. All of www, bip and ww+bip are listed.
- Look in the upload directories for files with executable extensions such as php, and for anything you did not place there. Compare file listings against a known good backup.
- Review web server logs for POST requests to the file upload endpoint from addresses you do not recognise, especially unauthenticated ones, followed by requests to newly created files.
find /var/www -type f \( -name "*.php" -o -name "*.phtml" \) -newer /var/www/html/index.php -path "*upload*"
Adjust the paths to match your layout. Any hit in an upload directory deserves a close look.
What to do now
- Treat the system as untrusted if it is internet facing. Take it offline or behind authentication at the network layer until you have a plan.
- Check for signs of compromise using the steps above. If you find unexpected executable files, preserve logs and the files, then rebuild from a clean source rather than cleaning in place.
- Block the upload endpoints at your reverse proxy or web application firewall. This is a stopgap, because the permission check is the broken part and other paths may exist.
- Configure the web server so that upload directories cannot execute scripts.
- Plan a migration to a supported content management system. The producer will not issue patches, so the exposure does not shrink with time.
- Rotate credentials and secrets held on the same server if you find evidence of misuse.
Why it matters
The record describes the cause as a permission check parameter that the client controls. The server trusts a value sent by the browser to decide whether an upload is allowed, so an unauthenticated visitor can simply claim the right to upload. This sits in CWE-434, unrestricted upload of a file with a dangerous type. The related flaw class is client side enforcement of a server side control, which the same advisory lists as a separate PAD CMS entry.
Uploading a script to a web root and then requesting it is a short path to code execution, which is why the score reaches 9.8. With no authentication and no user interaction needed, internet exposure is the main factor in your risk. End of life status makes it worse, because a known weakness will not be corrected by the producer. The only durable answer is to stop running the software.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a fix for CVE-2025-7063?
No. The record says PAD CMS is end of life and the producer will not publish patches. Retire it or isolate it.
Do I need to be logged in to be attacked?
No. The record describes an unauthenticated remote attacker. The permission check relies on a client controlled parameter, so no valid account is needed.
Sources
- CERT Polska: PAD CMS vulnerabilities
- NVD record for CVE-2025-7063, published 2025-09-30, CNA CERT Polska.
- Gold page for CVE-2025-7063
- Gold page for CWE-434
Last reviewed: 18 October 2026.
