CVE-2025-11138: Wenkucms OS Command Injection Vulnerability

CVE-2025-11138 Overview

CVE-2025-11138 is an operating system (OS) command injection vulnerability in mirweiye wenkucms versions up to 3.4. The flaw resides in the createPathOne function inside app/common/common.php. Attackers can manipulate input passed to this function to inject and execute arbitrary OS commands on the host. The vulnerability is exploitable over the network and a public exploit description has been disclosed, increasing the risk of opportunistic abuse against exposed instances. The weakness is classified under CWE-77: Improper Neutralization of Special Elements used in a Command.

Critical Impact
Authenticated remote attackers can inject OS commands through the createPathOne function in wenkucms ≤ 3.4, leading to arbitrary command execution on the underlying server.

Affected Products

mirweiye wenkucms 3.4
mirweiye wenkucms prior versions up to 3.4
Deployments using app/common/common.php containing the createPathOne function

Discovery Timeline

2025-09-29 - CVE-2025-11138 published to the National Vulnerability Database (NVD)
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-11138

Vulnerability Analysis

The vulnerability stems from improper neutralization of special elements passed to the createPathOne function within app/common/common.php. The function processes attacker-controlled input and incorporates it into an OS-level command without adequate sanitization or escaping. As a result, shell metacharacters and command separators reach the underlying command interpreter unchanged.

Exploitation requires network access and low-level privileges on the application. The Exploit Prediction Scoring System (EPSS) places this issue in the 70th percentile, reflecting moderate likelihood of exploitation activity in the wild. Public disclosure of exploit details on GitHub further reduces the technical barrier for attackers targeting exposed wenkucms instances.

Successful exploitation grants attackers the ability to execute arbitrary commands in the context of the web server process. This can be used to read sensitive files, pivot into adjacent systems, deploy webshells, or stage persistence on the host.

Root Cause

The root cause is missing input validation and command construction using unsafe string concatenation inside createPathOne. The function passes user-influenced data into a shell context without using parameterized APIs or strict allow-list filtering of path components.

Attack Vector

The attack vector is network-based. An attacker sends a crafted HTTP request to a wenkucms endpoint that ultimately invokes createPathOne. The crafted payload contains shell metacharacters such as ;, |, &&, or backticks, which break out of the intended command and execute attacker-supplied commands on the server. Public proof-of-concept information has been shared in the GitHub Issue Discussion.

No verified exploit code is reproduced here. Refer to the upstream advisory and the VulDB entry #326215 for technical details.

Detection Methods for CVE-2025-11138

Indicators of Compromise

HTTP requests targeting wenkucms endpoints containing shell metacharacters such as ;, |, &&, $(, or backticks in path or parameter values
Unexpected child processes (e.g., sh, bash, cmd.exe, powershell.exe) spawned by the PHP interpreter or web server user
New or modified files in the wenkucms web root, particularly PHP files written outside normal deployment workflows
Outbound network connections from the web server to unfamiliar hosts following suspicious HTTP activity

Detection Strategies

Inspect web server access logs for requests reaching code paths that invoke createPathOne in app/common/common.php
Enable PHP error and audit logging to capture anomalous calls to shell execution primitives such as system, exec, shell_exec, or passthru
Apply web application firewall (WAF) rules that flag command injection patterns in request parameters

Monitoring Recommendations

Correlate web request telemetry with process-creation events to identify the web server spawning shell utilities
Monitor file integrity on the wenkucms installation directory to detect unauthorized writes
Track egress traffic from the web server tier and alert on connections to non-approved destinations

How to Mitigate CVE-2025-11138

Immediate Actions Required

Restrict network exposure of wenkucms instances by placing them behind authenticated reverse proxies or VPN access until a fix is applied
Audit accounts that can reach the vulnerable code path and remove unnecessary low-privilege users
Review web server and application logs for prior indicators of exploitation against createPathOne

Patch Information

No vendor patch URL is listed in the available references for CVE-2025-11138. Operators should monitor the mirweiye wenkucms project for an updated release that addresses the createPathOne command injection and consult the VulDB CTI entry #326215 for remediation updates.

Workarounds

Apply a local code fix that validates inputs to createPathOne against a strict allow-list of permitted path characters
Replace shell-invoking calls with safer PHP filesystem APIs (e.g., mkdir) that do not pass arguments through a command interpreter
Deploy WAF signatures that block command injection metacharacters on routes interacting with the vulnerable function
Run the web server process with the minimum required OS privileges to limit the impact of successful exploitation

bash

# Configuration example: example WAF rule pattern to block shell metacharacters
# (Adapt to your WAF engine; this is illustrative ModSecurity-style syntax)
SecRule ARGS "@rx [;|&`$(){}]" \
    "id:1011138,phase:2,deny,status:403,msg:'Possible command injection targeting wenkucms createPathOne (CVE-2025-11138)'"