CVE-2025-67684

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2025-67684 affects Quick.Cart, an internet shop software, due to Local File Inclusion (LFI) and Path Traversal vulnerabilities in its theme selection mechanism. The application permits privileged users to upload arbitrary file contents while performing only superficial validation on the filename extension. This flaw enables attackers to upload PHP files that can then be included and executed, culminating in remote code execution (RCE) on the server. Only version 6.7 has been tested and confirmed vulnerable, though other versions may also be affected, as the vendor provided no details on the vulnerable range despite early notification.

Exploitation requires high privileges (PR:H), can be performed over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N), and results in unchanged scope (S:U) with high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), yielding a CVSS v3.1 base score of 7.2. A privileged attacker, such as an authenticated administrator, could leverage the theme upload feature to craft a malicious PHP file disguised with a valid extension, traverse paths to place it in an executable directory, and trigger its inclusion via theme selection, achieving full RCE.

Advisories note that the vendor was notified early but did not respond with vulnerability details, affected versions, or patches. Relevant references include a CERT.PL advisory at https://cert.pl/posts/2026/01/CVE-2025-67683 and the Quick.Cart product page at https://opensolution.org/sklep-internetowy-quick-cart.html, which provide further context but no specific mitigation guidance.