CVE-2025-10353: Melis Platform File Upload RCE Vulnerability

CVE-2025-10353 Overview

A critical file upload vulnerability exists in the "melis-cms-slider" module of Melis Technology's Melis Platform that allows attackers to achieve remote code execution (RCE). This vulnerability enables an attacker to upload a malicious file via a POST request to /melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm using the mcsdetail_img parameter. The lack of proper file type validation and sanitization allows arbitrary file uploads, which can be leveraged to execute malicious code on the target server.

Critical Impact

Unauthenticated attackers can achieve full remote code execution on vulnerable Melis Platform installations by uploading malicious files through the slider module, potentially leading to complete server compromise.

Affected Products

• Melis Technology Melis Platform (melis-cms-slider module)
• Melis CMS installations with the slider functionality enabled
• Web applications built on vulnerable Melis Platform versions

Discovery Timeline

• 2025-10-08 - CVE CVE-2025-10353 published to NVD
• 2025-12-11 - Last updated in NVD database

Technical Details for CVE-2025-10353

Vulnerability Analysis

This vulnerability is classified under CWE-43 (Path Equivalence: 'filename....' (Multiple Trailing Dot)), which relates to improper handling of file paths and names during the upload process. The core issue lies in the melis-cms-slider module's failure to properly validate and sanitize uploaded files through the mcsdetail_img parameter.

When a user uploads an image through the slider details form, the application does not adequately verify the file type, extension, or content. This allows an attacker to bypass the intended image upload restrictions and upload executable files such as PHP web shells or other malicious scripts. Once uploaded, these files can be accessed directly through the web server, enabling arbitrary code execution with the privileges of the web server process.

The network-accessible nature of this vulnerability, combined with the lack of authentication requirements, makes it particularly dangerous for internet-facing Melis Platform installations.

Root Cause

The root cause of this vulnerability is the insufficient input validation in the file upload handler within the MelisCmsSliderDetails controller. The saveDetailsForm action accepts file uploads through the mcsdetail_img parameter without properly validating:

• File extension whitelist enforcement
• MIME type verification against file content
• File content inspection for embedded executable code
• Proper sanitization of the filename to prevent path manipulation

This oversight allows attackers to craft requests that bypass any client-side validation and submit arbitrary files that will be stored and potentially executed by the server.

Attack Vector

The attack is conducted over the network and requires no user interaction or prior authentication. An attacker can exploit this vulnerability by:

1. Crafting a malicious file (e.g., a PHP web shell) disguised as an image or using extension manipulation techniques
2. Sending a POST request to the vulnerable endpoint /melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm
3. Including the malicious file in the mcsdetail_img parameter of the multipart form data
4. Once uploaded, locating the stored file on the server through predictable paths or directory enumeration
5. Executing the uploaded malicious code by directly accessing the file URL

The exploitation path allows for complete compromise of the web application and potentially the underlying server infrastructure.

For detailed technical information about this vulnerability, refer to the GitHub CVE-2025-10353 PoC repository and the INCIBE CERT Security Notice.

Detection Methods for CVE-2025-10353

Indicators of Compromise

• Unexpected files with executable extensions (.php, .phtml, .php5) in slider upload directories
• Web server logs showing POST requests to /melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm from suspicious IPs or with unusual file content types
• New or modified files in the slider media storage directories with recent timestamps
• Unusual outbound network connections from the web server process

Detection Strategies

• Implement file integrity monitoring on Melis Platform upload directories to detect unauthorized file additions or modifications
• Configure web application firewall (WAF) rules to inspect multipart form uploads and block requests containing executable content or suspicious file extensions
• Enable detailed access logging for all requests to the MelisCmsSlider module endpoints
• Deploy endpoint detection and response (EDR) solutions like SentinelOne to detect and prevent web shell execution attempts

Monitoring Recommendations

• Establish baseline behavioral analysis for web server processes and alert on anomalous child process spawning or network activity
• Monitor for HTTP requests to newly created files in upload directories, which may indicate successful exploitation and web shell access attempts
• Set up alerts for file uploads containing PHP code signatures or other executable content patterns
• Review web server error logs for signs of attempted exploitation such as path traversal attempts or file parsing errors

How to Mitigate CVE-2025-10353

Immediate Actions Required

• Restrict access to the /melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm endpoint to authenticated and authorized users only
• Implement strict file type validation on the server-side that checks both file extensions and MIME types against a whitelist of allowed image formats
• Consider temporarily disabling the slider module if it is not critical to operations until a patch is available
• Audit existing uploaded files in slider directories for any suspicious or executable content

Patch Information

At the time of writing, no official vendor patch has been documented in the available CVE data. Organizations using Melis Platform should:

• Monitor the INCIBE CERT Security Notice for updated guidance and patch availability
• Contact Melis Technology directly for security updates and patching information
• Subscribe to Melis Platform security announcements for notification of fixes

Workarounds

• Implement server-side file upload validation that verifies file content matches expected image formats using file signature (magic byte) checking
• Configure the web server to prevent execution of PHP or other scripts in upload directories by adding appropriate directives (e.g., php_flag engine off for Apache)
• Deploy a reverse proxy or WAF to filter and sanitize file uploads before they reach the application
• Restrict network access to administrative interfaces and file upload endpoints to trusted IP addresses only
• Store uploaded files outside the web root and serve them through a sanitizing proxy that sets appropriate content-type headers

# Apache configuration to prevent script execution in upload directories
<Directory "/path/to/melis/uploads/slider">
    php_flag engine off
    <FilesMatch "\.(php|phtml|php5|php7|phps)$">
        Require all denied
    </FilesMatch>
</Directory>