CVE-2025-10993: Muyucms RCE Vulnerability via Template

CVE-2025-10993 Overview

CVE-2025-10993 is a code injection vulnerability affecting MuYuCMS versions up to 2.7. The flaw resides in the Template Management component accessed through the /admin.php file. Attackers can manipulate template handling functionality to inject arbitrary code into the application. Exploitation occurs remotely over the network but requires high privileges on the target system.

The vulnerability is classified under [CWE-74] Improper Neutralization of Special Elements in Output and [CWE-94] Improper Control of Generation of Code.

Critical Impact
Authenticated attackers with administrative access can inject code through MuYuCMS Template Management, potentially leading to arbitrary code execution within the CMS context.

Affected Products

MuYuCMS versions up to and including 2.7
MuYuCMS /admin.php Template Management component
All deployments exposing the administrative interface to network access

Discovery Timeline

2025-09-26 - CVE-2025-10993 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10993

Vulnerability Analysis

The vulnerability exists within the Template Management functionality of MuYuCMS. The /admin.php endpoint processes template-related operations without adequate neutralization of input that flows into code generation routines. An authenticated administrator can submit crafted template data that the application interprets as executable code.

MuYuCMS, like many PHP-based content management systems, renders templates by composing PHP code from stored template definitions. When user-controlled input reaches the template compilation or evaluation path without sanitization, attackers can break out of the template context and inject arbitrary PHP statements.

The attack delivers limited impact to confidentiality, integrity, and availability of the CMS instance. The scope remains within the affected component, and the privilege requirement reduces exposure compared to unauthenticated injection flaws.

Root Cause

The root cause is improper neutralization of special elements [CWE-74] combined with unsafe code generation [CWE-94] in the Template Management workflow. The application accepts template content from privileged users and incorporates it into executable code paths without applying allowlists, escaping, or sandboxing. Trust in administrative input is the underlying design assumption that enables the injection.

Attack Vector

The attack vector is network-based and targets the administrative interface. An attacker must first obtain valid administrator credentials, either through credential theft, weak password reuse, or compromise of an existing administrator session. The attacker then authenticates to /admin.php, navigates to the Template Management feature, and submits a crafted template payload. The injected code executes when the template is processed or rendered by the CMS.

The vulnerability mechanism is described in the Gitee Issue Report and indexed in VulDB #325921. No public proof-of-concept exploit has been published at the time of NVD publication.

Detection Methods for CVE-2025-10993

Indicators of Compromise

Unexpected modifications to template files in the MuYuCMS installation directory
New PHP files or suspicious PHP statements appearing within template storage paths
Unusual outbound network connections originating from the web server process after administrative activity
Administrator session activity from unfamiliar IP addresses preceding template changes

Detection Strategies

Monitor HTTP POST requests to /admin.php parameters related to template editing and inspect payloads for PHP tags, eval, system, or exec substrings
Compare template files against a known-good baseline and alert on unauthorized changes
Enable PHP error and access logging to capture anomalous template compilation activity
Correlate administrative authentication events with subsequent template modification operations

Monitoring Recommendations

Audit all administrator accounts and review login history for unauthorized access
Track file integrity on the template/ directory and any generated PHP cache files
Forward web server and application logs to a centralized analytics platform for retention and search
Alert on web shell signatures and unexpected process spawns from the PHP interpreter

How to Mitigate CVE-2025-10993

Immediate Actions Required

Restrict access to the /admin.php endpoint using IP allowlists or VPN-only access where feasible
Rotate all administrator credentials and enforce strong, unique passwords
Review template files for unauthorized modifications and restore from clean backups if tampering is found
Audit administrator accounts and remove any unused or unrecognized accounts

Patch Information

At the time of NVD publication, no official patched version has been referenced. Monitor the MuYuCMS Gitee repository for upstream fixes and apply updates promptly when released. Track the VulDB advisory for additional remediation guidance.

Workarounds

Limit the number of administrator accounts and apply the principle of least privilege
Place the MuYuCMS administrative interface behind a web application firewall configured to inspect template parameters
Disable the Template Management feature if it is not required for ongoing operations
Run the PHP process under a restricted user with no shell access and minimal filesystem permissions

bash

# Example nginx configuration to restrict access to /admin.php by source IP
location = /admin.php {
    allow 10.0.0.0/8;        # internal admin network
    deny all;
    fastcgi_pass unix:/run/php/php-fpm.sock;
    include fastcgi_params;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
}