CVE-2025-2195: Mrcms 3.1.2 XSS Vulnerability

CVE-2025-2195 Overview

CVE-2025-2195 is a cross-site scripting (XSS) vulnerability affecting MRCMS 3.1.2. The flaw resides in the rename function of /admin/file/rename.do within the org.marker.mushroom.controller.FileController component. An authenticated attacker can manipulate the name or path argument to inject script content that executes in the context of another user's browser session.

The vulnerability has been publicly disclosed, and the vendor did not respond to disclosure attempts. The weakness is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
An authenticated attacker can inject arbitrary JavaScript through the file rename endpoint, enabling session theft, administrative action hijacking, and content manipulation within the MRCMS admin panel.

Affected Products

MRCMS 3.1.2
org.marker.mushroom.controller.FileController component
/admin/file/rename.do endpoint

Discovery Timeline

2025-03-11 - CVE-2025-2195 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2195

Vulnerability Analysis

The vulnerability exists in the file rename handler exposed by MRCMS at /admin/file/rename.do. The FileController class accepts user-supplied name and path parameters without applying output encoding or input sanitization. When the resulting file metadata is rendered back into the admin interface, injected markup executes in the browser.

Exploitation requires low-privilege authentication and user interaction, since a victim must load the affected admin view. Successful attacks execute JavaScript under the origin of the MRCMS administrative panel. Consequences include theft of session cookies, forgery of authenticated requests, and defacement of admin views.

The issue is a stored XSS pattern because the malicious payload persists in file metadata and re-executes each time the affected view is loaded. This amplifies impact beyond a one-off reflected payload.

Root Cause

The root cause is missing output encoding in the file rename workflow. The FileController.rename method treats the name and path inputs as trusted string values and does not neutralize HTML control characters such as <, >, ", and ' before persisting or rendering them.

Attack Vector

The attack vector is network-based. An authenticated attacker submits a rename request to /admin/file/rename.do with a payload embedded in the name or path parameter. When any admin user subsequently views the file listing or related administrative pages, the injected script executes in that user's browser context.

Technical details are documented in the GitHub Issue Report and the VulDB Vulnerability Report. No verified proof-of-concept code has been curated for this article.

Detection Methods for CVE-2025-2195

Indicators of Compromise

HTTP POST requests to /admin/file/rename.do containing HTML metacharacters (<, >, ", ') or script keywords in the name or path parameters.
File names stored in the MRCMS backend that include <script>, onerror=, onload=, or javascript: sequences.
Admin session activity originating from unexpected IP addresses shortly after suspicious rename requests.

Detection Strategies

Deploy web application firewall (WAF) signatures that flag script tags and event handler attributes in rename.do request bodies.
Review MRCMS application logs for rename operations where the new file name contains non-alphanumeric characters outside an allowlist.
Inspect the file storage directory for filenames that would not be valid on standard filesystems, which indicates injection attempts rather than legitimate renames.

Monitoring Recommendations

Alert on repeated failed or anomalous POST requests to /admin/file/rename.do from the same session.
Correlate admin authentication events with subsequent script execution errors reported in browser telemetry.
Monitor outbound traffic from administrator workstations for beacons to unfamiliar domains after admin panel access.

How to Mitigate CVE-2025-2195

Immediate Actions Required

Restrict access to the MRCMS /admin/ path to trusted IP ranges using network or reverse-proxy controls.
Audit existing accounts and remove unnecessary admin privileges, since exploitation requires authentication.
Review file names already stored by MRCMS and remove any entries containing HTML or script content.

Patch Information

No vendor patch is available. The MRCMS vendor did not respond to disclosure attempts. Organizations using MRCMS 3.1.2 should evaluate migration to an actively maintained content management system or apply the workarounds below until an upstream fix is released. Refer to the VulDB entry for advisory updates.

Workarounds

Place MRCMS behind a WAF configured to strip or block HTML metacharacters in the name and path parameters of /admin/file/rename.do.
Enforce a strict Content Security Policy (CSP) on the admin interface to block inline script execution.
Require multi-factor authentication for administrative accounts to reduce the pool of accounts that can trigger the vulnerable code path.
Disable or reverse-proxy-block the /admin/file/rename.do endpoint if the file rename feature is not in active use.

bash

# Example nginx rule to block script-like payloads in rename requests
location = /admin/file/rename.do {
    if ($args ~* "(<|%3C)script") { return 403; }
    if ($request_body ~* "(<|%3C)script") { return 403; }
    proxy_pass http://mrcms_backend;
}