CVE-2025-30091

Deeper analysis

Tiny MoxieManager PHP before version 4.0.0 contains a remote code execution vulnerability in its installer command. The flaw stems from CWE-96 and permits unauthenticated insertion of attacker-controlled data via InstallCommand directly into the generated config.php file, with the command remaining reachable even after initial setup completes. The issue carries a CVSS 4.0 score of 9.4 reflecting network-accessible, low-complexity exploitation with high impact across confidentiality, integrity, and availability.

An attacker can supply malicious input to InstallCommand to write and execute arbitrary PHP code on the server. Because the endpoint stays available post-installation and requires no authentication, the attack can be launched remotely by any party able to reach the MoxieManager instance, resulting in full compromise of the affected web application and underlying host.

Public advisories and the product changelog at moxiemanager.com address the issue under identifier SEC-1063 and document the availability of version 4.0.0 as the corrective release. The associated EPSS score remains low, with a current value of 0.0140 and a peak of only 0.0168.