CVE-2025-8226: Medium Information Disclosure in ChanCMS

CVE-2025-8226 is a medium severity (CVSS 4.3) information disclosure in ChanCMS up to 3.1.2. The /sysApp/find endpoint can return access and secret keys. The record says version 3.1.3 addresses it, and because keys may have been exposed, rotating them matters as much as upgrading.

What's affected

ChanCMS from yanyutao0402, versions up to 3.1.2, per the record. The affected file is /sysApp/find, and the record names the accessKey and secretKey values as the manipulated arguments. The record says upgrading to 3.1.3 is able to address the issue.

Here the sources differ in what they confirm. The Gitee issue linked from the record describes the problem as an unauthorized API exposure of the access key and secret key, and marks the issue as completed. It does not state the affected or fixed version, and it links no commit or release. So 3.1.3 as the fixed version comes from the record only. Check the ChanCMS releases page to confirm.

The issue text also claims the exposure could lead to account takeover and abuse of cloud resources. That is the reporter's claim, not something I verified. Gitee has marked the issue as sensitive, so parts of it may not be visible to you.

Severity is 4.3 (medium) in the record, with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. If the keys protect cloud storage or paid services, the real impact can be larger than the score suggests.

How to check if you're exposed

Find the ChanCMS version in the project's package.json or the admin panel. Anything up to 3.1.2 is in scope.

grep '"version"' package.json

Then check whether the /sysApp/find route is reachable from outside your network and whether it answers without a session. Test only your own deployments. Review access logs for requests to that path from unfamiliar addresses.

Finally, identify which keys the application stores in its system settings, such as object storage or third party service keys. Those are the values at risk.

What to do now

1. Upgrade ChanCMS to 3.1.3 or later after confirming the release.
2. Rotate every access key and secret key stored in the application's system settings, since exposure may already have happened.
3. Review the cloud provider's logs for use of those keys from unknown addresses.
4. Restrict the admin and API routes to trusted networks while you upgrade.
5. Scope keys to the minimum permissions, so one leak does not expose everything.

Why it matters

The record classes this as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) together with CWE-284 (Improper Access Control). An endpoint meant for administrators returns secrets to a caller who should not see them.

Credential disclosure is quiet. There is no crash and no error, and the first sign may be a surprise cloud bill. The record does not flag this CVE as CISA KEV, and it makes no claim of exploitation in the wild, though it says the exploit has been disclosed to the public.

Quick check

Sources

• CVE-2025-8226 on Safeguard Gold
• ChanCMS issue on Gitee
• NVD record for CVE-2025-8226, published 2025-07-27

Last reviewed: 18 October 2026.