Chestnutcms
Vendor:
First CVE: Jan 6, 2025 · Active for 1 year
11
Total CVEs
More Total CVEs than 90% of tracked products
5.5
Avg CVEs / Year
Higher CVE frequency than 91% of tracked products
7.5
Avg CVSS
Higher Avg CVSS than 63% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Chestnutcms over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jan 6, 2025
18 months ago
Most Recent CVE
Feb 5, 2026
173 days ago
CVE Severity & Scoring
Chestnutcms11 CVEs
9%
9%
64%
18%
All CVEs353,173 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local0 (0.0%)
Network10 (90.9%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network1 (9.1%)
Attack Complexity
Low11 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None10 (90.9%)
Unknown0 (0.0%)
Required1 (9.1%)
Privileges Required
Low4 (36.4%)
High2 (18.2%)
None5 (45.5%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (11 CVEs).
11 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-15009HIGH A flaw has been found in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function FilenameUtils.getExtension of the file /dev-api/common/upload of the component Fil | Dec 22, 2025 | 8.8 | 27 | NO | NO |
CVE-2024-56828CRITICAL File Upload vulnerability in ChestnutCMS through 1.5.0. Based on the code analysis, it was determined that the /api/member/avatar API endpoint receives a base64 string as input. Th | Jan 6, 2025 | 9.8 | 26 | NO | NO |
CVE-2025-70073HIGH An issue in ChestnutCMS v.1.5.8 and before allows a remote attacker to execute arbitrary code via the template creation function | Feb 5, 2026 | 7.2 | 25 | NO | NO |
CVE-2024-57450CRITICAL ChestnutCMS <=1.5.0 is vulnerable to File Upload via the Create template function. | Feb 3, 2025 | 9.8 | 25 | NO | NO |
CVE-2025-5552HIGH A vulnerability was found in ChestnutCMS up to 15.1. It has been declared as critical. This vulnerability affects unknown code of the file /dev-api/groovy/exec of the component API | Jun 4, 2025 | 8.8 | 24 | NO | NO |
CVE-2025-2917HIGH A vulnerability, which was classified as problematic, was found in ChestnutCMS up to 1.5.3. Affected is the function readFile of the file /dev-api/cms/file/read. The manipulation o | Mar 28, 2025 | 7.5 | 22 | NO | NO |
CVE-2025-2031HIGH A vulnerability classified as critical has been found in ChestnutCMS up to 1.5.2. This affects the function uploadFile of the file /dev-api/cms/file/upload. The manipulation of the | Mar 6, 2025 | 7.6 | 21 | NO | NO |
CVE-2024-57451HIGH ChestnutCMS <=1.5.0 has a directory traversal vulnerability in contentcore.controller.FileController#getFileList, which allows attackers to view any directory. | Feb 3, 2025 | 7.5 | 20 | NO | NO |
CVE-2024-57452HIGH ChestnutCMS <=1.5.0 has an arbitrary file deletion vulnerability in contentcore.controller.FileController, which allows attackers to delete any file and folder. | Feb 3, 2025 | 7.5 | 20 | NO | NO |
CVE-2025-12923MEDIUM A vulnerability was determined in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function resourceDownload of the file /dev-api/common/download. Executing manipula | Nov 10, 2025 | 4.9 | 19 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (11 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (11 CVEs).
Media Mentions
Signals from CVEs in this product scope (11 CVEs).
Top CNAs Publishing CVEs For Chestnutcms
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 1.5.2 | 2 | 5.5 | 0.4% | 0 | 0 |