1000mz maintains Chestnut CMS, a modestly represented content-management platform whose vulnerabilities skew toward serious outcomes and concentrate in file-handling and access-control weakness classes such as path traversal, unrestricted file uploads, improper access control, unsafe deserialization, and exposure of sensitive resources. These flaws are characteristic of web application codebases where user input validation and administrative boundary enforcement demand sustained attention. Live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by 1000mz over time
Signals from CVEs in this vendor scope (11 CVEs).
11 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-15009HIGH A flaw has been found in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function FilenameUtils.getExtension of the file /dev-api/common/upload of the component Fil | Dec 22, 2025 | 8.8 | 27 | NO | NO |
CVE-2024-56828CRITICAL File Upload vulnerability in ChestnutCMS through 1.5.0. Based on the code analysis, it was determined that the /api/member/avatar API endpoint receives a base64 string as input. Th | Jan 6, 2025 | 9.8 | 26 | NO | NO |
CVE-2025-70073HIGH An issue in ChestnutCMS v.1.5.8 and before allows a remote attacker to execute arbitrary code via the template creation function | Feb 5, 2026 | 7.2 | 25 | NO | NO |
CVE-2024-57450CRITICAL ChestnutCMS <=1.5.0 is vulnerable to File Upload via the Create template function. | Feb 3, 2025 | 9.8 | 25 | NO | NO |
CVE-2025-5552HIGH A vulnerability was found in ChestnutCMS up to 15.1. It has been declared as critical. This vulnerability affects unknown code of the file /dev-api/groovy/exec of the component API | Jun 4, 2025 | 8.8 | 24 | NO | NO |
CVE-2025-2917HIGH A vulnerability, which was classified as problematic, was found in ChestnutCMS up to 1.5.3. Affected is the function readFile of the file /dev-api/cms/file/read. The manipulation o | Mar 28, 2025 | 7.5 | 22 | NO | NO |
CVE-2025-2031HIGH A vulnerability classified as critical has been found in ChestnutCMS up to 1.5.2. This affects the function uploadFile of the file /dev-api/cms/file/upload. The manipulation of the | Mar 6, 2025 | 7.6 | 21 | NO | NO |
CVE-2024-57451HIGH ChestnutCMS <=1.5.0 has a directory traversal vulnerability in contentcore.controller.FileController#getFileList, which allows attackers to view any directory. | Feb 3, 2025 | 7.5 | 20 | NO | NO |
CVE-2024-57452HIGH ChestnutCMS <=1.5.0 has an arbitrary file deletion vulnerability in contentcore.controller.FileController, which allows attackers to delete any file and folder. | Feb 3, 2025 | 7.5 | 20 | NO | NO |
CVE-2025-12923MEDIUM A vulnerability was determined in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function resourceDownload of the file /dev-api/common/download. Executing manipula | Nov 10, 2025 | 4.9 | 19 | NO | NO |
Signals from CVEs in this vendor scope (11 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by 1000mz.
Media articles that mention a CVE ID that affects a product developed by 1000mz — matched by CVE ID, not by vendor name.