CVE-2025-58449: 
PHP vulnerability analysis and mitigation

CVE-2025-58449 is an authenticated remote code execution (RCE) vulnerability in Maho, a free and open-source ecommerce platform, caused by insufficient file upload extension validation in the product custom options feature. Authenticated staff users with Dashboard and Catalog\Manage Products permissions can configure a file upload custom option to allow .php extensions, bypassing the application's enforced extension blocklist. The vulnerability affects Maho versions prior to 25.9.0 (specifically confirmed in 25.7.0). It was published on September 7–8, 2025, and carries a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Maho Security Advisory).

The root cause is classified as CWE-646 (Reliance on File Name or Extension of Externally-Supplied File). When a staff user creates a product custom option of type "file upload," the application allows the user to define their own extension whitelist without validating it against the server-side forbidden extensions list. This means a user can add .php (or variants like .phtml, .php5) to the allowed list, and subsequently uploaded files are written to a predictable, web-accessible path: /public/media/custom_options/<hash>/<option_id>/<filename>.php. Because this directory is under the application's webroot and served directly by the web server, an attacker can trigger PHP execution by making an HTTP request to the uploaded file's URL. The fix (commit db54a1b) enforces a server-side forbidden extensions blocklist — now covering php, php3, php4, php5, php7, php8, phtml, phar, exe, bat, cmd, asp, aspx, jsp, and others — at both save time and upload time (GitHub Advisory, Patch Commit).

Successful exploitation grants the attacker arbitrary PHP code execution on the web server, running as the web server process user. This enables full confidentiality, integrity, and availability compromise of the vulnerable system and potentially subsequent systems — including access to the database (customer PII, payment data), installation of persistent backdoors, lateral movement within the hosting environment, and complete service disruption. The impact is high across all three CIA dimensions for both the vulnerable and subsequent systems (Maho Security Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.087% (0.201% per GitHub Advisory, 42nd percentile), indicating a relatively low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access with specific staff-level permissions (Catalog\Manage Products), which limits the attacker pool but does not require full administrative access.

1. Obtain staff credentials: Acquire or compromise a Maho staff account that has Dashboard and Catalog\Manage Products role permissions — this could be via phishing, credential stuffing, or insider threat.
2. Log in to the admin panel: Navigate to /admin and authenticate with the staff account.
3. Select a target product: From the dashboard (e.g., via the "Most Viewed Products" widget), navigate to any product in the catalog.
4. Create a malicious custom option: Go to the "Custom Options" tab on the product edit page. Add a new custom option of type "File" (file upload). In the "Compatible File Extensions" field, enter php as an allowed extension.
5. Save the product: Save the product configuration. The malicious extension whitelist is now stored without server-side validation (in versions prior to 25.9.0).
6. Upload the PHP web shell: In a separate browser session (e.g., private window, as a customer), navigate to the product's storefront page. Use the file upload custom option to upload a PHP reverse shell or web shell file (e.g., shell.php). Click "Add to Cart" to complete the upload.
7. Determine the file path: Calculate the uploaded file's location on the server: /public/media/custom_options/<quote_id>/<option_id>/shell.php. The path components can be inferred from the cart/session data or by brute-forcing predictable values.
8. Trigger code execution: Make an HTTP GET request to https://<target>/media/custom_options/<quote_id>/<option_id>/shell.php to cause the web server to execute the PHP payload, establishing a reverse shell or enabling further post-exploitation (Maho Security Advisory).

• Network: HTTP POST requests to product admin edit pages (/admin/catalog_product/edit/) containing file_extension parameters with values like php, phtml, or other executable extensions; HTTP GET requests to paths matching /media/custom_options/*/*/*.php or similar executable extensions from external IPs.
• File System: Presence of .php, .phtml, or other script files under /public/media/custom_options/; unexpected web shells or reverse shell scripts in the media directory.
• Logs: Web server access logs showing requests to /media/custom_options/ paths with .php extensions, especially followed by outbound connections; admin access logs showing a staff user modifying product custom options with executable file extensions.
• Process: Unusual child processes spawned by the PHP-FPM or Apache/Nginx worker process (e.g., bash, curl, wget, nc) originating from the web server process user (Maho Security Advisory).

Upgrade Maho to version 25.9.0 or later, which enforces a server-side forbidden extensions blocklist (including php, php3–php8, phtml, phar, exe, bat, asp, aspx, jsp, and others) at both option save time and file upload time (Patch Commit). As interim mitigations: restrict the Catalog\Manage Products permission to fully trusted staff only; configure the web server to deny execution of scripts in the /public/media/ directory (e.g., via .htaccess or Nginx location blocks); and deploy a WAF rule to block file uploads with executable extensions to the custom options endpoint (GitHub Advisory).