CVE-2025-8838

CVE-2025-8838 describes an improper authentication vulnerability in the Backend Interface component of WinterChenS my-site, affecting versions up to commit 1f7525f15934d9d6a278de967f6ec9f1757738d8. By manipulating the 'uri' argument in the preHandle function of the /admin/ path, an unauthenticated attacker can bypass security controls. This critical vulnerability, rated 9.8 CVSS, allows for remote exploitation with high impact on confidentiality, integrity, and availability. While the exploit has been publicly disclosed and community discussion is high, its real-world existence is currently doubted by the maintainer, and there is no evidence of active exploitation or readily available exploit tools like Metasploit or Nuclei.