Raytha CMSにおける認証済みRCE

The impact of CVE-2025-15540 is severe. An attacker exploiting this vulnerability can execute arbitrary .NET code within the Raytha CMS application's hosting environment. This grants them complete control over the server, enabling data theft, modification, or deletion. They could also establish a persistent foothold, enabling lateral movement to other systems on the network. The ability to instantiate .NET components directly elevates the risk significantly, as it bypasses typical application-level security controls. The blast radius extends to any sensitive data processed or stored by the Raytha CMS application and potentially to other systems accessible from the compromised server.

Organizations using Raytha CMS with privileged user accounts are at risk. This includes websites and applications that rely on Raytha CMS for content management or custom functionality. Shared hosting environments where multiple users share the same server are particularly vulnerable, as a compromised account could potentially impact other websites on the same server.

• windows / dotnet: Use PowerShell to check for suspicious .NET assemblies or code execution patterns within the Raytha CMS installation directory.

Get-ChildItem -Path "C:\Path\To\Raytha\CMS\Functions" -Filter *.dll -Recurse | Select-Object -ExpandProperty FullName

• linux / server: Monitor system logs for unusual .NET process executions or errors related to the Raytha CMS application. Use lsof to identify processes accessing Raytha CMS files.

lsof | grep raytha

• generic web: Monitor web server access logs for requests targeting the "functions" feature with unusual parameters. Check for unexpected .NET components being instantiated.

1. 2026-03-16Disclosure

   disclosure

1. 予約済み2026-01-19
2. 公開日2026-03-16
3. EPSS 更新日2026-03-23

The primary mitigation for CVE-2025-15540 is to immediately upgrade Raytha CMS to version 1.4.6 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict access to the "functions" feature to only authorized personnel. Implement strict input validation and sanitization on any user-supplied code passed to the "functions" module. While a WAF might offer some protection, it's unlikely to be sufficient against this type of vulnerability. Thoroughly review any custom code added through the "functions" feature to ensure it does not contain malicious intent. After upgrading, confirm the fix by attempting to execute arbitrary code through the "functions" feature – it should be rejected.