CVE-2025-11136: Wanglongcn Yifang RCE Vulnerability

CVE-2025-11136 Overview

CVE-2025-11136 is an unrestricted file upload vulnerability affecting YiFang CMS versions up to 2.0.2. The flaw resides in the webUploader function of app/app/controller/File.php within the Backend component. An authenticated attacker can manipulate the uploadpath argument to write arbitrary files to attacker-controlled locations on the server. The vulnerability is classified under [CWE-284] Improper Access Control and is exploitable remotely over the network. A public exploit reference has been published via GitHub and VulDB, increasing the likelihood of opportunistic abuse against exposed deployments.

Critical Impact

Authenticated remote attackers can upload arbitrary files through the webUploader function, potentially enabling webshell deployment and remote code execution on the YiFang CMS backend.

Affected Products

• YiFang CMS versions up to and including 2.0.2
• wanglongcn:yifang Backend component
• Deployments exposing app/app/controller/File.php to authenticated users

Discovery Timeline

• 2025-09-29 - CVE-2025-11136 published to NVD
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-11136

Vulnerability Analysis

The vulnerability resides in the webUploader function inside app/app/controller/File.php, a Backend handler responsible for processing file uploads in YiFang CMS. The function consumes a user-supplied uploadpath argument without sufficient validation or access control checks. As a result, an attacker authenticated to the backend can direct uploads to arbitrary paths and bypass intended file-type restrictions. The classification under [CWE-284] Improper Access Control indicates the upload routine fails to enforce the privilege and path constraints expected by the application. Exploitation can lead to arbitrary file write, and where the target directory is web-accessible, the attacker can stage a server-side script for follow-on remote code execution.

Root Cause

The root cause is missing validation of the uploadpath parameter combined with insufficient enforcement of file-type and destination directory restrictions in the webUploader handler. The backend trusts the client-controlled path value when storing uploaded content.

Attack Vector

The attack is launched remotely over the network. The attacker must hold backend privileges to reach the webUploader endpoint, then submits a crafted upload request that manipulates uploadpath to place a malicious file in a writable, executable location. No user interaction is required.

No verified exploit code is reproduced here. Refer to the GitHub Issue Report and VulDB CTI Entry #326213 for published technical details.

Detection Methods for CVE-2025-11136

Indicators of Compromise

• Unexpected files (especially .php, .phtml, .phar) appearing in upload directories or outside the standard media path
• HTTP POST requests to the webUploader endpoint containing uploadpath values referencing directory traversal sequences or web-executable paths
• Backend authentication followed by anomalous file write activity to web-accessible directories
• Web server processes spawning shell interpreters such as sh, bash, or cmd.exe from PHP worker contexts

Detection Strategies

• Inspect web server access logs for requests targeting File.php with the webUploader action and abnormal uploadpath parameters
• Monitor the YiFang CMS webroot for newly written executable script files using file integrity monitoring
• Correlate backend administrative logins with subsequent file creation events under web-serving directories

Monitoring Recommendations

• Enable verbose application logging for all upload handlers and forward to a centralized log platform for retention and analysis
• Alert on outbound network connections initiated by the web server user immediately following an upload event
• Track changes to the app/app/controller/File.php request rate and parameter distribution as a baseline anomaly signal

How to Mitigate CVE-2025-11136

Immediate Actions Required

• Restrict access to the YiFang CMS backend to trusted networks using IP allowlists or VPN-only access
• Audit existing backend user accounts and remove or rotate credentials for unused or shared accounts
• Review the YiFang CMS upload directories for unauthorized files and remove any suspicious scripts
• Disable PHP execution in directories intended only for media storage at the web server level

Patch Information

No official vendor patch advisory is referenced in the NVD record at this time. Monitor the wanglongcn YiFang CMS repository and VulDB entry #326213 for fix availability. Until a vendor patch is published, apply the workarounds below and validate that upgrades, when released, include input validation on the uploadpath argument in webUploader.

Workarounds

• Apply a web application firewall rule that blocks requests to File.php containing uploadpath values with path traversal characters or unexpected absolute paths
• Configure the web server to deny script execution within all directories writable by the application
• Enforce server-side allowlists for upload destination directories and file extensions in any custom deployment patches
• Place the YiFang CMS backend behind an authenticating reverse proxy to limit pre-authentication exposure

# Example nginx configuration to disable PHP execution in upload paths
location ^~ /uploads/ {
    location ~ \.(php|phtml|phar|php5|php7)$ {
        deny all;
        return 403;
    }
}