CVE-2025-56704
LeptonCMS version 7.3.0 contains an arbitrary file upload vulnerability, which is caused by the lack of proper validation for uploaded files.
Published Dec 9, 2025 · updated Oct 14, 2026 · lepton-cms leptoncms
LeptonCMS version 7.3.0 contains an arbitrary file upload vulnerability, which is caused by the lack of proper validation for uploaded files. An authenticated attacker can exploit this vulnerability by uploading a specially crafted ZIP/PHP file to execute arbitrary code.
Timeline
Detection, updates, and resolution for this record.
Dec 9, 2025 · NIST NVD
Detected
LeptonCMS version 7.3.0 contains an arbitrary file upload vulnerability, which is caused by the lack of proper validation for uploaded files. An authenticated attacker can exploit this vulnerability by uploading a specially crafted ZIP/PHP file to execute arbitrary code.
Oct 14, 2026 · NIST NVD
Updated
LeptonCMS version 7.3.0 contains an arbitrary file upload vulnerability, which is caused by the lack of proper validation for uploaded files. An authenticated attacker can exploit this vulnerability by uploading a specially crafted ZIP/PHP file to execute arbitrary code.
Affected
- cpe lepton-cms/leptoncms7.3.0
Sources
- CVE.orgCVE-2025-56704
Official CVE identifier
cve.org - FIRST EPSSCVE-2025-56704
30-day exploitation probability 0.8%
first.org - NIST NVDCVE-2025-56704
LeptonCMS version 7.3.0 contains an arbitrary file upload vulnerability, which is caused by the lack of proper validation for uploaded files. An authenticated attacker can exploit this vulnerability by uploading a specially crafted ZIP/PHP file to execute arbitrary code.
nvd.nist.gov