---
id: CVE-2025-56704
title: >-
  LeptonCMS version 7.3.0 contains an arbitrary file upload vulnerability, which
  is caused by the lack of proper validation for uploaded files
summary: >-
  LeptonCMS version 7.3.0 contains an arbitrary file upload vulnerability, which
  is caused by the lack of proper validation for uploaded files. An
  authenticated attacker can exploit this vulnerability by uploading a specially
  crafted ZIP/P…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-434
  - CWE-434
vendor: lepton-cms
product: leptoncms
affected:
  - leptoncms = 7.3.0
published: '2025-12-09'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T21:10:00.183'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-56704'
references:
  - url: >-
      https://github.com/Kayi626/Vulns/blob/UserAccount/LEPTON_CMS_7.3.0_File_Upload_A.pdf
    label: cve@mitre.org
  - url: >-
      https://github.com/Kayi626/Vulns/blob/UserAccount/LEPTON_CMS_7.3.0_File_Upload_B.pdf
    label: cve@mitre.org
  - url: >-
      https://github.com/Kayi626/Vulns/blob/UserAccount/LEPTON_CMS_7.3.0_File_Upload_C.pdf
    label: cve@mitre.org
tags:
  - nvd
epss: 0.00766
epssPercentile: 0.54486
ingestedAt: '2026-10-14T21:57:04.751Z'
---

## Overview

LeptonCMS version 7.3.0 contains an arbitrary file upload vulnerability, which is caused by the lack of proper validation for uploaded files. An authenticated attacker can exploit this vulnerability by uploading a specially crafted ZIP/PHP file to execute arbitrary code.

## Affected

- `leptoncms = 7.3.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.