Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HSummary
CVE-2025-67164 is a critical-severity OS Command Injection (CWE-78) vulnerability in Pagekit Pagekit. Its CVSS base score is 9.9 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked at the 39th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-67164 is an authenticated arbitrary file upload vulnerability in the /storage/poc.php component of Pagekit CMS version 1.0.18. Published on 2025-12-17, it enables attackers to execute arbitrary code by uploading a crafted PHP file, with associated weakness enumerations including CWE-78, CWE-94, and CWE-434. The vulnerability carries a CVSS v3.1 base score of 9.9, indicating critical severity.
An attacker with low privileges (PR:L), such as an authenticated user, can exploit this remotely (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Exploitation changes scope (S:C) and results in high impacts to confidentiality (C:H), integrity (I:H), and availability (A:H), potentially allowing full remote code execution on the server.
A proof-of-concept exploit is documented in the vulnerability research repository at https://github.com/mbiesiad/vulnerability-research/tree/main/CVE-2025-67164. No official advisories or patch details are specified in the available information.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-203907
Vulnerability Data
An authenticated arbitrary file upload vulnerability in the /storage/poc.php component of Pagekit CMS v1.0.18 allows attackers to execute arbitrary code via uploading a crafted PHP file.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.1.1V1.2.5V1.2.8V15.2.5
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover missing or incorrect command sanitization during development.
Input validation directly neutralizes or rejects special characters that would otherwise alter OS command structure.
Malicious-code protection at entry points blocks dangerous file types from being accepted and executed.
Least privilege reduces the permissions available to any process that could be subverted by injected commands.
Least functionality restricts available OS commands and interpreters, limiting the blast radius of injection.
Requiring documented secure development standards and tools enforces use of safe code-generation APIs and escaping.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Restricting execution of unauthorized software directly blocks dangerous uploaded files from running.
PR.PS-06's SDLC practices directly require secure coding and input handling that blocks command-injection defects, yet the single broad outcome leaves many specific neutralization vectors and verification gaps unaddressed.
Hardened configuration baselines can enforce allowed file types and processing rules.
Routine patching/maintenance can remediate known command-injection CVEs in dependencies (partial forward) but does nothing to stop developers from introducing improper neutralization in custom code (none reverse).
PR.DS-10 protects runtime data confidentiality/integrity but has no bearing on neutralizing externally influenced input during code generation, so neither direction shows any preventive effect.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing and code review target insecure use of operating-system command interfaces, catching command-injection flaws introduced during development.
Secure-coding guidelines and security testing explicitly address restrictions on allowed file types and upload handling, reducing the risk that dangerous file uploads are accepted without validation.
Banning unapproved code samples and unauthenticated web services, combined with secure-coding standards and SAST, prevents the dynamic generation or inclusion of attacker-supplied code.
Mandated testing for malicious content and known vulnerabilities reduces the likelihood that an outsourced component will contain or accept dangerous file types that could later be uploaded or executed.
Application allow-listing and pre-use scanning of received files directly blocks the introduction of executable content that has not been vetted, eliminating the primary vector for unrestricted dangerous file uploads.