CVE-2025-8226 is a critical information disclosure vulnerability affecting yanyutao0402 ChanCMS versions up to 3.1.2. By manipulating the accessKey/secretKey arguments in the /sysApp/find file, an attacker can remotely extract sensitive information. This vulnerability has a CVSS score of 9.8 (Critical) due to its network-based attack vector, low complexity, and high impact on confidentiality, integrity, and availability. While not yet in the KEV catalog, exploit details are publicly available, and the vulnerability has garnered significant community discussion, indicating a high potential for exploitation. Upgrading to ChanCMS version 3.1.3 is recommended to mitigate this risk.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 3.1.3CPE matchmatch criteria | cpe:2.3:a:chancms:chancms:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.