Cyber Resilience

CVE-2025-58449

Published
08 September 2025
Modified
15 April 2026
CVSS Score v4 8.7
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0031 23th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2025-58449 is a high-severity Reliance on File Name or Extension of Externally-Supplied File (CWE-646) vulnerability. Its CVSS base score is 8.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Double File Extension (T1036.007); ranked at the 23th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A06:2025 Insecure Design

EU & UK References

Vulnerability Data

Maho is a free and open source ecommerce platform. In Maho prior to 25.9.0, an authenticated staff user with access to the `Dashboard` and `Catalog\Manage Products` permissions can create a custom option on a listing with a file input field.…

more

By allowing file uploads with a `.php` extension, the user can use the filed to upload malicious PHP files, gaining remote code execution. Version 25.9.0 fixes the issue.

CWE(s)
CWE-646

Related Threats

MITRE ATT&CK Enterprise Techniques

T1036.007 Double File Extension Stealth
Adversaries may abuse a double extension in the filename as a means of masquerading the true file type.
attack.mitre.org →
T1036 Masquerading Stealth
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.
attack.mitre.org →
T1036.002 Right-to-Left Override Stealth
Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a string and/or file name to make it appear benign.
attack.mitre.org →
T1036.006 Space after Filename Stealth
Adversaries can hide a program's true filetype by changing the extension of a file.
attack.mitre.org →
T1036.008 Masquerade File Type Stealth
Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, icon, and contents.
attack.mitre.org →
T1505 Server Software Component Persistence
Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-52052Shared CWE-646
CVE-2025-30662Shared CWE-646
CVE-2025-41720Shared CWE-646
CVE-2026-20172Shared CWE-646
CVE-2025-1889Shared CWE-646
CVE-2023-45599Shared CWE-646
CVE-2024-38432Shared CWE-646
CVE-2026-45315Shared CWE-646

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match

Requires validation of information inputs, which structurally stops reliance on untrusted file names or extensions by forcing content-based checks.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require content-based validation instead of trusting file extensions for externally supplied files.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect the weakness, but the control does not guarantee its elimination.

A.8.19 Installation of software on operational systems partial match
degrades

Restricting software installation can limit dangerous file types but does not enforce content-based validation.

A.8.23 Web filtering partial match
degrades

Web filtering can block risky file extensions but does not address server-side file handling logic.

A.8.25 Secure development life cycle partial match
prevents

Secure SDLC requires proper file-type validation, directly mitigating reliance on untrusted names or extensions.

A.8.26 Application security requirements partial match
prevents

Application security requirements can mandate content inspection, but the control itself does not prescribe the technique.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles encourage safe file handling, yet the control is broader than this specific weakness.

References