CVE-2025-12331: Willow CMS Unrestricted Upload RCE Flaw

CVE-2025-12331 Overview

CVE-2025-12331 affects Willow CMS versions up to 1.4.0 and exposes an unrestricted file upload weakness in the /admin/images/add endpoint. An authenticated administrator-level attacker can abuse this endpoint over the network to upload arbitrary files. The flaw is tracked under CWE-284 (Improper Access Control) and CWE-434 (Unrestricted Upload of File with Dangerous Type). Public exploit details have been disclosed through VulDB and a related GitHub issue. The vulnerability carries a low CVSS 4.0 base score of 2.0 because exploitation requires high-privilege access.

Critical Impact
Authenticated attackers with administrator privileges can upload arbitrary file types through the Willow CMS image upload handler, undermining content integrity and confidentiality.

Affected Products

Matthewdeaves Willow CMS versions up to and including 1.4.0
The /admin/images/add upload handler
Deployments exposing the Willow CMS admin interface to untrusted networks

Discovery Timeline

2025-10-27 - CVE-2025-12331 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12331

Vulnerability Analysis

The vulnerability resides in the image upload functionality exposed at /admin/images/add within Willow CMS. The handler accepts uploaded files without enforcing restrictions on file type, extension, or content. This allows an attacker who already holds administrator credentials to place arbitrary files into the application's storage paths. Because the validation deficiency falls under both improper access control ([CWE-284]) and unrestricted upload ([CWE-434]), it represents a layered weakness in the admin workflow. The issue is documented in the project's GitHub Issue Discussion and the VulDB CTI ID #330116 record.

Root Cause

The upload endpoint does not validate the MIME type, file extension, or magic bytes of submitted files. Server-side checks that should reject non-image content are missing or insufficient. The endpoint relies on administrative trust boundaries rather than content inspection to gate uploads.

Attack Vector

Exploitation requires network access to the admin interface and valid high-privilege credentials. An attacker sends a multipart POST request to /admin/images/add containing a file that is not a legitimate image. The server stores the file in a location reachable by subsequent requests, enabling content tampering or staging of follow-on actions. No user interaction beyond the attacker's own session is required.

No verified proof-of-concept code is available. Refer to the VulDB Submission #674439 and VulDB #330116 records for additional technical context.

Detection Methods for CVE-2025-12331

Indicators of Compromise

POST requests to /admin/images/add containing files whose extensions or MIME types do not match standard image formats such as .jpg, .png, .gif, or .webp.
New files appearing in the Willow CMS image storage directory with executable, script, or archive extensions.
Administrator session activity from unexpected IP addresses immediately preceding upload events.

Detection Strategies

Inspect web server access logs for POST /admin/images/add entries and correlate with the resulting stored filenames.
Apply file-type validation at a Web Application Firewall (WAF) layer to alert when uploaded content does not match declared image MIME types.
Compare file integrity baselines for the CMS upload directories and flag deviations.

Monitoring Recommendations

Forward Willow CMS application logs and web server logs to a centralized SIEM for correlation.
Alert on admin authentication events that precede file uploads from new geolocations or user agents.
Track outbound connections from the web server to detect post-upload callback behavior.

How to Mitigate CVE-2025-12331

Immediate Actions Required

Restrict access to /admin/images/add to trusted networks or VPN segments until a fix is applied.
Audit existing administrator accounts and rotate credentials for any account with image management rights.
Review the image upload directory for files that do not match expected image content.

Patch Information

No fixed version has been published in the enriched data at the time of writing. Track the upstream GitHub Issue Discussion for remediation progress, and upgrade to a version later than 1.4.0 once released.

Workarounds

Place the admin interface behind an authenticated reverse proxy that enforces MIME and extension allow-lists on uploads.
Configure the web server to deny execution of scripts within the image storage directory.
Reduce the number of accounts assigned administrator privileges to limit the exploitable attack surface.

bash

# Example nginx configuration to block script execution in upload directories
location ^~ /webroot/files/Images/ {
    location ~ \.(php|phtml|phar|pl|py|sh|cgi)$ {
        deny all;
        return 403;
    }
}