CVE-2025-46359 Overview
CVE-2025-46359 is a path traversal vulnerability [CWE-22] in the backup and restore feature of Alfasado PowerCMS. An authenticated product administrator can execute arbitrary code by uploading a crafted backup file during the restore operation. The flaw stems from insufficient validation of file paths embedded inside backup archives, allowing files to be written outside the intended restore directory. Affected deployments include PowerCMS versions prior to 6.7.1, 5.3.1, and 4.6.1, which Alfasado addressed in a coordinated release.
Critical Impact
An authenticated administrator can write attacker-controlled files to arbitrary filesystem locations, leading to arbitrary code execution on the PowerCMS host.
Affected Products
- Alfasado PowerCMS versions prior to 6.7.1
- Alfasado PowerCMS versions prior to 5.3.1
- Alfasado PowerCMS versions prior to 4.6.1
Discovery Timeline
- 2025-07-31 - CVE-2025-46359 published to NVD
- 2025-08-06 - Last updated in NVD database
Technical Details for CVE-2025-46359
Vulnerability Analysis
The vulnerability resides in PowerCMS's backup and restore workflow. PowerCMS allows administrators to export site state into a backup archive and later restore it through the administration interface. During restore, the application reads file path entries from the supplied archive and writes their contents to disk. PowerCMS does not properly canonicalize or constrain these paths, so entries containing ../ traversal sequences or absolute paths escape the intended restore directory.
An attacker holding administrator credentials can craft a backup archive whose entries point at sensitive locations on the host, including PHP-executable web directories. Restoring the archive places an attacker-controlled script onto the server, which the web tier then executes. The result is arbitrary code execution in the context of the PowerCMS process. The EPSS score of 1.276% (79.9 percentile) reflects above-average exploitation likelihood for an administrator-gated flaw.
Root Cause
The root cause is missing path validation on archive entries during restore. PowerCMS trusts filenames inside the backup archive instead of normalizing them and verifying they resolve inside the designated restore root. This is a classic [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.
Attack Vector
Exploitation requires network access to the PowerCMS administration interface and valid administrator credentials. The attacker generates a malicious backup file containing path-traversal entries that map a PHP payload to a web-accessible directory. The attacker uploads the archive through the restore function. PowerCMS extracts the archive, writes the payload outside the restore directory, and any subsequent HTTP request to the planted file triggers code execution.
No verified public proof-of-concept code is available. Refer to the JVN Advisory JVNVU93412964 for additional technical context.
Detection Methods for CVE-2025-46359
Indicators of Compromise
- Backup restore operations in PowerCMS logs originating from unexpected administrator accounts or IP addresses.
- New or modified .php, .cgi, or template files in PowerCMS web directories with timestamps matching a restore event.
- Archive entries containing ../ sequences or absolute paths inside uploaded PowerCMS backup files.
- Outbound network connections from the PowerCMS host immediately following a restore action.
Detection Strategies
- Audit PowerCMS application logs for restore actions and correlate against authorized change windows.
- Inspect uploaded backup archives statically before restore by listing entries and rejecting any path containing .. or starting with /.
- File integrity monitoring on the PowerCMS document root and plugin directories to flag unexpected writes.
- Alert on administrator session activity from unfamiliar geographies or user agents.
Monitoring Recommendations
- Forward web server access logs and PowerCMS application logs to a centralized analytics platform for retention and correlation.
- Monitor process creation on the PowerCMS host for shells or interpreters spawned by the web server user after restore operations.
- Track creation of executable files in web-served directories and alert on any write outside the application's deployment pipeline.
How to Mitigate CVE-2025-46359
Immediate Actions Required
- Upgrade PowerCMS to 6.7.1, 5.3.1, or 4.6.1 depending on the deployed major version branch.
- Restrict administrator account access to trusted networks using IP allowlists or VPN-only access.
- Rotate PowerCMS administrator credentials and enforce multi-factor authentication where supported.
- Review recent restore operations and inspect the filesystem for unauthorized files written outside expected directories.
Patch Information
Alfasado released fixed versions PowerCMS 6.7.1, 5.3.1, and 4.6.1. Refer to the PowerCMS Release Notes 6.7.1 for upgrade instructions and the JVN Advisory JVNVU93412964 for coordinated disclosure details.
Workarounds
- Disable the backup restore feature for non-essential administrators until patching completes.
- Place the PowerCMS administration interface behind a reverse proxy that enforces source-IP restrictions.
- Manually inspect backup archives before any restore by listing entries and rejecting those with traversal sequences.
# Inspect a PowerCMS backup archive for path traversal entries before restoring
tar -tf backup.tar.gz | grep -E '(^/|\.\./)' && echo 'UNSAFE ARCHIVE - DO NOT RESTORE'
# For zip-format backups
unzip -l backup.zip | awk '{print $4}' | grep -E '(^/|\.\./)'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
