CVE-2025-8120

CVE-2025-8120 is a critical Remote Code Execution (RCE) vulnerability affecting all templates of the widzialni PAD CMS, a product that is End-of-Life. An unauthenticated remote attacker can exploit a flaw in the upload photo functionality, allowing them to upload and execute arbitrary files due to client-controlled permission checks. This vulnerability carries a CVSS score of 9.8 (CRITICAL), indicating a severe risk with network-based exploitation, low attack complexity, and no user interaction required, leading to complete compromise of confidentiality, integrity, and availability. Its FAUCET Risk Score is 95/100, highlighting its significant danger. While there is no evidence of active exploitation, nor publicly available exploit code in Metasploit, Nuclei, or ExploitDB, the vulnerability has garnered some community discussion, with one mention indicating awareness of the critical RCE flaw. Given the product's EOL status, no patches will be released, necessitating immediate mitigation actions such as disabling the upload functionality and network segmentation.