CVE-2025-10353

Deeper analysis

CVE-2025-10353 is an unrestricted file upload vulnerability that leads to remote code execution in the melis-cms-slider module of Melis Technology's Melis Platform. The flaw resides in the endpoint /melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm, where the mcsdetail_img parameter accepts arbitrary files without sufficient validation, enabling an attacker to place executable content on the server.

An unauthenticated remote attacker can exploit the issue by sending a crafted POST request containing a malicious file. Successful exploitation grants the ability to execute arbitrary code on the underlying server with the privileges of the web application process, resulting in full compromise of confidentiality, integrity, and availability.

Public references include a proof-of-concept on GitHub and an INCIBE advisory that addresses multiple vulnerabilities affecting the Melis Platform.

The EPSS score rose materially from a low baseline to a peak of 0.0758 on 2026-02-18 before receding, indicating that exploitation interest increased after disclosure.