CVE-2025-8120 is a critical (CVSS 9.8) unrestricted file upload leading to remote code execution in PAD CMS. CERT Polska says all versions up to 1.2.1 are affected and that no patch will come because the product is end of life. The practical answer is to take it off the internet and replace it.
What's affected
The record lists PAD CMS versions up to and including 1.2.1, all three templates (www, bip and www+bip) as affected. The vulnerable code is in the photo upload function.
There is no fix. CERT Polska says the product is end of life and the producer will not publish patches.
The upload photo function relies on a permission check parameter that the client controls. An unauthenticated remote attacker can therefore upload files of any type and extension, and those files can then be executed.
The record's CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, a score of 9.8. CERT Polska names the producer as Polska Akademia Dostepnosci and says it found the issue in its own research.
The record's kev flag is false, so the CVE is not in CISA's Known Exploited Vulnerabilities catalog at the time of this review.
How to check if you're exposed
PAD CMS is used by Polish public bodies for information bulletin sites, so look for the three template names (www, bip and www+bip) in your site configuration, and check the version against 1.2.1. Then look for files in your upload directories that are not images:
find /var/www -path "*upload*" -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" \) 2>/dev/null
Any script file in an upload directory deserves immediate attention and an incident review.
A free in-browser dependency scan at gold.safeguard.sh/scan can show whether this CVE appears in a project's dependency list. Note that it covers packages. Stand-alone applications and firmware are best checked against your own inventory.
What to do now
- Identify every PAD CMS site you run and confirm the version.
- Plan a migration to a maintained CMS. There is no patch and none is planned.
- Until then, block the photo upload function at your web server or WAF, and stop the upload directory from executing scripts.
- Search upload directories for script files and treat any you find as a compromise.
- Put the site behind a WAF and restrict administrative paths by address.
If you maintain a codebase and want to know whether a vulnerable package is actually called, Safeguard's reachability analysis separates packages that are present from code paths that are used.
Why it matters
The weakness class here is CWE-434 (unrestricted upload of a dangerous file type). The detail that makes this one worse is that the permission check is a parameter supplied by the client, so the server is asking the visitor whether the visitor is allowed. Authorization decisions have to be made server side from the session.
The record's kev flag is false, but with an unauthenticated route to code execution and no patch coming, waiting for exploitation news is the wrong trigger for action.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a patch for CVE-2025-8120?
The record does not name a fixed version, and for PAD CMS CERT Polska says none will be published. Treat the product as unpatched, reduce its exposure and check the vendor or project site for news.
Is CVE-2025-8120 being exploited in the wild?
The record's kev flag is false, so it is not in CISA's Known Exploited Vulnerabilities catalog. No advisory I read says it is being exploited.
Sources
- Safeguard Gold entry for CVE-2025-8120
- CERT Polska advisory post
- NVD record data for CVE-2025-8120, published 2025-09-30, source cvd@cert.pl
Last reviewed: 18 October 2026.
