Paymenter Vulnerable to Remote Code Execution via Public File Uploads

The impact of CVE-2025-58048 is severe due to the potential for Remote Code Execution (RCE). A malicious, authenticated user can leverage this vulnerability to upload and execute arbitrary code on the server. This could involve extracting sensitive data from the Paymenter database, including customer information, order details, and potentially even payment credentials. Attackers could also read credentials stored in configuration files, gaining access to other systems or services. Furthermore, the ability to execute arbitrary system commands under the web server user context allows for complete control over the affected system, potentially leading to data breaches, denial of service, and further lateral movement within the network. The blast radius extends to any data accessible by the web server user, and the ease of exploitation makes it a high-priority concern.

1. 予約済み2025-08-22
2. 公開日2025-08-28
3. EPSS 更新日2026-03-23

The primary mitigation for CVE-2025-58048 is to immediately upgrade Paymenter to version 1.2.11. This version includes a patch (commit 87c3db4) that addresses the arbitrary file upload vulnerability. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict file upload permissions within the ticket attachments functionality to only allow specific, safe file types. Implement strict input validation on all uploaded files to prevent the execution of malicious code. Consider using a Web Application Firewall (WAF) to filter out potentially malicious file uploads. Monitor Paymenter logs for suspicious activity, such as unusual file uploads or attempts to execute commands. After upgrading to 1.2.11, verify the fix by attempting to upload a known malicious file type and confirming that the upload is blocked or handled safely.