https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-70073.htmlhttps://patchthecve.com/cve/CVE-2025-70073.htmlWed, 17 Jun 2026 10:03:06 +0000HIGH 7.2: An issue in ChestnutCMS v.1.5.8 and before allows a remote attacker to execute arbitrary code via the template creation functionhttps://patchthecve.com/cve/CVE-2025-15009.htmlhttps://patchthecve.com/cve/CVE-2025-15009.htmlMon, 19 Oct 2026 22:10:00 +0000MEDIUM 6.3: A flaw has been found in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function FilenameUtils.getExtension of the file /dev-api/common/upload of the component Filename Handler. Executing manipulation of the argument File can lead to unrestricted upload. The attack may be launched rhttps://patchthecve.com/cve/CVE-2025-12923.htmlhttps://patchthecve.com/cve/CVE-2025-12923.htmlWed, 07 Oct 2026 21:10:00 +0000LOW 2.7: A vulnerability was determined in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function resourceDownload of the file /dev-api/common/download. Executing manipulation of the argument path can lead to path traversal. The attack can be launched remotely. The exploit has been publiclyhttps://patchthecve.com/cve/CVE-2025-2917.htmlhttps://patchthecve.com/cve/CVE-2025-2917.htmlWed, 17 Jun 2026 09:07:50 +0000MEDIUM 4.3: A vulnerability, which was classified as problematic, was found in ChestnutCMS up to 1.5.3. Affected is the function readFile of the file /dev-api/cms/file/read. The manipulation of the argument filePath leads to path traversal. It is possible to launch the attack remotely. The exploit has been dischttps://patchthecve.com/cve/CVE-2024-57451.htmlhttps://patchthecve.com/cve/CVE-2024-57451.htmlWed, 17 Jun 2026 08:13:36 +0000HIGH 7.5: ChestnutCMS <=1.5.0 has a directory traversal vulnerability in contentcore.controller.FileController#getFileList, which allows attackers to view any directory.https://patchthecve.com/cve/CVE-2024-57452.htmlhttps://patchthecve.com/cve/CVE-2024-57452.htmlWed, 17 Jun 2026 08:13:36 +0000HIGH 7.5: ChestnutCMS <=1.5.0 has an arbitrary file deletion vulnerability in contentcore.controller.FileController, which allows attackers to delete any file and folder.https://patchthecve.com/cve/CVE-2024-57450.htmlhttps://patchthecve.com/cve/CVE-2024-57450.htmlWed, 17 Jun 2026 08:13:35 +0000CRITICAL 9.8: ChestnutCMS <=1.5.0 is vulnerable to File Upload via the Create template function.https://patchthecve.com/cve/CVE-2024-56828.htmlhttps://patchthecve.com/cve/CVE-2024-56828.htmlWed, 17 Jun 2026 08:13:01 +0000CRITICAL 9.8: File Upload vulnerability in ChestnutCMS through 1.5.0. Based on the code analysis, it was determined that the /api/member/avatar API endpoint receives a base64 string as input. This string is then passed to the memberService.uploadAvatarByBase64 method for processing. Within the service, the base64