CVE-2025-15540: RCE in Raytha CMS Functions Module

The impact of CVE-2025-15540 is severe. An attacker exploiting this vulnerability can execute arbitrary .NET code within the Raytha CMS application's hosting environment. This grants them complete control over the server, enabling data theft, modification, or deletion. They could also establish a persistent foothold, enabling lateral movement to other systems on the network. The ability to instantiate .NET components directly elevates the risk significantly, as it bypasses typical application-level security controls. The blast radius extends to any sensitive data processed or stored by the Raytha CMS application and potentially to other systems accessible from the compromised server.

1. Reserved2026-01-19
2. Published2026-03-16
3. EPSS updated2026-03-23

The primary mitigation for CVE-2025-15540 is to immediately upgrade Raytha CMS to version 1.4.6 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict access to the "functions" feature to only authorized personnel. Implement strict input validation and sanitization on any user-supplied code passed to the "functions" module. While a WAF might offer some protection, it's unlikely to be sufficient against this type of vulnerability. Thoroughly review any custom code added through the "functions" feature to ensure it does not contain malicious intent. After upgrading, confirm the fix by attempting to execute arbitrary code through the "functions" feature – it should be rejected.