CVE-2025-69770
Published: 13 February 2026
Summary
CVE-2025-69770 is a critical-severity Path Traversal (CWE-22) vulnerability in Mojoportal (inferred from references). Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 45.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-69770 is a zip slip vulnerability (CWE-22) affecting the /DesignTools/SkinList.aspx endpoint in MojoPortal CMS version 2.9.0.1. It enables attackers to execute arbitrary commands by uploading a specially crafted zip file. The vulnerability carries a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low attack complexity, lack of required privileges or user interaction, and potential for high impact across confidentiality, integrity, and availability with a change in scope.
Unauthenticated remote attackers can exploit this vulnerability over the network by submitting a malicious zip file to the affected endpoint. Successful exploitation allows arbitrary command execution on the server, potentially leading to full system compromise, data theft, or further lateral movement within the environment.
Advisories and release notes, available at the MojoPortal GitHub security page (https://github.com/i7MEDIA/mojoportal/security), a detailed writeup (https://github.com/kid-tnt/Mojo-check/blob/main/Zipslip%20in%20MojoPortal%20version%202.9.0.1.md), and the v2.9.1 release page (https://www.mojoportal.com/mojoportal-2-9-1), recommend updating to MojoPortal CMS version 2.9.1 or later to mitigate the issue.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206963
Vulnerability details
A zip slip vulnerability in the /DesignTools/SkinList.aspx endpoint of MojoPortal CMS v2.9.0.1 allows attackers to execute arbitrary commands via uploading a crafted zip file.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Zip slip RCE on public-facing web endpoint directly enables unauthenticated remote exploitation (T1190) followed by arbitrary command execution (T1059).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the zip slip vulnerability by applying the vendor-recommended patch to MojoPortal CMS version 2.9.1 or later.
Prevents path traversal exploitation in zip file uploads by enforcing validation of file paths and contents at the /DesignTools/SkinList.aspx endpoint.
Blocks unauthenticated attackers from uploading crafted zip files by explicitly authorizing only safe actions without identification or authentication on the vulnerable endpoint.