CVE-2025-58449

Summary

Maho is a free and open source ecommerce platform. In Maho prior to 25.9.0, an authenticated staff user with access to the Dashboard and Catalog\Manage Products permissions can create a custom option on a listing with a file input field. By allowing file uploads with a .php extension, the user can use the filed to upload malicious PHP files, gaining remote code execution. Version 25.9.0 fixes the issue.

Affected Software

VendorProductVersion RangeStatus
MahoCommercemaho< 25.9.0affected

Weaknesses

  • CWE-646: CWE-646: Reliance on File Name or Extension of Externally-Supplied File

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: total

Additional References

References