{"id":"CVE-2025-58048","title":"Paymenter vulnerable to Remote Code Execution via public file uploads","summary":"Paymenter vulnerable to Remote Code Execution via public file uploads","severity":"critical","cvss":9.9,"cwe":["CWE-434"],"vendor":"paymenter","product":"paymenter/paymenter","ecosystem":"composer","affected":["paymenter/paymenter < 1.2.11"],"patched":["paymenter/paymenter 1.2.11"],"published":"2026-06-22","updated":"2026-06-22","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-5pm9-r2m8-rcmj","references":[{"url":"https://github.com/Paymenter/Paymenter/security/advisories/GHSA-5pm9-r2m8-rcmj"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58048"},{"url":"https://github.com/Paymenter/Paymenter/commit/87c3db42282ada1e3cda54b9a01f846926c0669b"},{"url":"https://github.com/Paymenter/Paymenter/releases/tag/v1.2.11"},{"url":"https://github.com/advisories/GHSA-5pm9-r2m8-rcmj"}],"tags":["ghsa","composer"],"epss":0.00414,"epssPercentile":0.32955,"ingestedAt":"2026-06-29T13:24:35.671Z","slug":"CVE-2025-58048","body":"## Overview\n\n### Impact\n\nThe ticket attachments functionality in Paymenter allows a malicious authenticated user to upload arbitrary files.\n\nWith the ability to execute arbitrary code, this vulnerability can be exploited in numerous ways, including but not limited to:\n- Extracting sensitive data from the database (e.g. customer information).\n- Reading credentials from .env or other configuration files.\n- Running arbitrary system commands under the web server user context.\n\nThis issue is Critical as it allows a low-privilege authenticated user to fully compromise the application and underlying server.\n\n### Patches\nThis vulnerability was patched by https://github.com/Paymenter/Paymenter/commit/87c3db42282ada1e3cda54b9a01f846926c0669b and was released under the [v1.2.11](https://github.com/Paymenter/Paymenter/releases/tag/v1.2.11) tag without any other code modifications compared to v1.2.10.\n\n### Work arounds\nIf upgrading is not immediately possible, administrators can mitigate this vulnerability with one or more of the following measures:\n\n- Updating nginx config to download attachments instead of executing them:\n```\nlocation ^~ /storage/ {\n    types { }\n    default_type application/octet-stream;\n    add_header X-Content-Type-Options nosniff;\n    try_files $uri =404;\n}\n```\n- Disallow access to /storage/ fully using a WAF such as Cloudflare\n\nThese workarounds significantly reduce risk, but the only guaranteed resolution is upgrading to v1.2.11 or later.\n\n## Affected packages\n\n- `paymenter/paymenter < 1.2.11`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `paymenter/paymenter 1.2.11`","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":54.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}