CVE-2025-54815

HighPublic PoCRCE

Published: 19 September 2025

Published

19 September 2025

Modified

25 September 2025

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0026 48.7th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-54815 is a high-severity Code Injection (CWE-94) vulnerability in Yandaozi Ppress. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 48.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Flaw remediation directly patches the SSTI vulnerability in PPress 0.0.9, preventing arbitrary code execution from crafted themes.

SI-10 Information Input Validation good match

prevent

Information input validation mechanisms sanitize and validate crafted theme inputs to block server-side template injection.

RA-5 Vulnerability Monitoring and Scanning good match

detect

Vulnerability monitoring and scanning identifies the specific SSTI flaw in PPress 0.0.9 for prompt remediation.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1221 Template Injection Stealth

Adversaries may create or modify references in user document templates to conceal malicious code or force authentication attempts.

attack.mitre.org →

Why these techniques?

The SSTI vulnerability in PPress CMS enables remote code execution via crafted themes in a public-facing web application (T1190: Exploit Public-Facing Application) and directly facilitates template injection for arbitrary code execution (T1221: Template Injection).

NVD Description

Server-side template injection (SSTI) vulnerability in PPress 0.0.9 allows attackers to execute arbitrary code via crafted themes.

Deeper analysisAI

CVE-2025-54815 is a server-side template injection (SSTI) vulnerability in PPress version 0.0.9. The flaw, classified under CWE-94, enables attackers to execute arbitrary code through crafted themes. Published on 2025-09-19, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.

The vulnerability can be exploited by attackers with low privileges, such as authenticated users, over the network with low complexity and no requirement for user interaction. Successful attacks allow remote arbitrary code execution, resulting in high impacts on confidentiality, integrity, and availability.

Advisories and additional details are documented in the referenced repositories, including vulnerability chain specifics at https://github.com/quarter77/PPress-CMS_vulnerability_chain_details/blob/main/CVE-2025-54815%20Details.md and the PPress v0.0.9-beta release page at https://github.com/yandaozi/PPress/releases/tag/v0.0.9-beta.