CVE-2025-67164: 
PHP vulnerability analysis and mitigation

CVE-2025-67164 is an authenticated arbitrary file upload vulnerability in Pagekit CMS v1.0.18 that allows attackers to execute arbitrary code by uploading a crafted PHP file to the /storage/ component. The vulnerability was discovered by Michal Biesiada in November 2025 and publicly disclosed on December 17, 2025. It affects Pagekit CMS version 1.0.18 and all prior versions (≤ 1.0.18); notably, the Pagekit project has been archived since December 1, 2023, meaning no official patch will be released by the vendor. The CVSS v3.1 base score is 9.9 (Critical), assigned by CISA-ADP (Github Advisory, Feedly).

The root cause is an unrestricted file upload flaw (CWE-434) in Pagekit's storage component, compounded by code injection (CWE-94) and OS command injection (CWE-78) weaknesses, as the uploaded PHP file is placed in a web-accessible directory and can be directly executed by the web server. An authenticated attacker with low-privilege credentials can send a crafted multipart HTTP request to the /storage/poc.php endpoint, uploading a malicious PHP webshell or reverse shell payload without adequate file type validation. The primary precondition is possession of any valid authenticated session on the Pagekit instance; no elevated privileges are required. A public proof-of-concept with screenshots demonstrating persistent webshell installation is available in the researcher's GitHub repository (PoC, Github Advisory).

Successful exploitation results in remote code execution (RCE) on the underlying server, enabling an attacker to install a persistent webshell, exfiltrate sensitive data, modify or delete files, and potentially pivot to other systems on the same network. The vulnerability's changed scope (S:C) in the CVSS vector indicates that the impact extends beyond the Pagekit application itself to the broader hosting environment. All three security pillars are fully compromised: confidentiality (unauthorized data access), integrity (file and system modification), and availability (potential denial of service or system disruption) (Github Advisory, Feedly).

A public proof-of-concept exploit is available on GitHub, published by the vulnerability's discoverer, Michal Biesiada (PoC). As of the time of reporting, there is no confirmed evidence of active in-the-wild exploitation, and no threat actor attribution has been made. The EPSS score is approximately 0.071–0.112% (29th percentile), indicating a relatively low but non-negligible probability of exploitation within 30 days (Github Advisory). The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify internet-facing Pagekit CMS instances running version 1.0.18 or earlier using search engines (e.g., Shodan, Censys) or web fingerprinting tools targeting Pagekit-specific paths and headers.
2. Obtain credentials: Acquire low-privilege authenticated credentials via phishing, credential stuffing, or brute force against the Pagekit login endpoint.
3. Authenticate: Log in to the Pagekit CMS instance and obtain a valid session token or cookie.
4. Craft malicious payload: Prepare a PHP webshell file (e.g., shell.php) containing code such as <?php system($_GET['cmd']); ?> or a more sophisticated reverse shell.
5. Upload malicious file: Send a crafted multipart HTTP POST request to the /storage/ endpoint (e.g., /storage/poc.php) with the malicious PHP file as the upload payload, bypassing any file type restrictions.
6. Execute arbitrary code: Access the uploaded file directly via the web server (e.g., https://target.com/storage/shell.php?cmd=id) to trigger remote code execution and establish persistent access (PoC).

• Network: Unusual HTTP POST requests to /storage/ endpoints with multipart form data containing .php file uploads; outbound connections from the web server process to unknown external IPs (indicative of reverse shell activity).
• File System: Presence of unexpected .php files (e.g., poc.php, shell.php, cmd.php) in the Pagekit /storage/ directory or other web-accessible directories; modification timestamps on storage directories inconsistent with normal CMS activity.
• Logs: Web server access logs showing POST requests to /storage/ paths followed by GET requests to the same uploaded file path; repeated authentication attempts from unfamiliar IP addresses preceding the upload.
• Process: Unusual child processes spawned by the web server process (e.g., php, /bin/sh, bash, curl, wget) executing system commands not typical of normal CMS operation (PoC).

Since Pagekit has been archived since December 1, 2023, no official vendor patch exists or is expected; the GitHub Advisory Database lists "None" for patched versions (Github Advisory). Organizations should strongly consider migrating to an actively maintained CMS. As immediate workarounds: restrict or block web access to the /storage/ directory via web server configuration (e.g., deny execution of PHP files in that directory using .htaccess or Nginx rules); implement strict file upload validation at the WAF or application layer to block PHP file uploads; and limit authenticated user permissions to the minimum required. Monitor access logs for suspicious upload activity and consider taking vulnerable instances offline if migration is not immediately feasible (Feedly).

The vulnerability was noted in cybersecurity aggregation blogs covering high-severity CVEs published in December 2025, and was indexed by multiple vulnerability tracking platforms including VulDB, Vulners, and CVEFeed shortly after disclosure (Feedly). The GitHub Advisory Database flagged the advisory as Critical and noted the project's archived status, highlighting the risk of using unmaintained software (Github Advisory). No significant vendor statements or notable researcher commentary beyond the discoverer's own write-up have been identified.