CVE-2025-69770

Critical

Published: 13 February 2026

Published

13 February 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS Score 0.0004 13.9th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-69770 is a critical-severity Path Traversal (CWE-22) vulnerability in Mojoportal (inferred from references). Its CVSS base score is 10.0 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 13.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly mitigates the zip slip vulnerability by applying the vendor-recommended patch to MojoPortal CMS version 2.9.1 or later.

SI-10 Information Input Validation good match

prevent

Prevents path traversal exploitation in zip file uploads by enforcing validation of file paths and contents at the /DesignTools/SkinList.aspx endpoint.

AC-14 Permitted Actions Without Identification or Authentication good match

prevent

Blocks unauthenticated attackers from uploading crafted zip files by explicitly authorizing only safe actions without identification or authentication on the vulnerable endpoint.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059 Command and Scripting Interpreter Execution

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

attack.mitre.org →

Why these techniques?

Zip slip RCE on public-facing web endpoint directly enables unauthenticated remote exploitation (T1190) followed by arbitrary command execution (T1059).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A zip slip vulnerability in the /DesignTools/SkinList.aspx endpoint of MojoPortal CMS v2.9.0.1 allows attackers to execute arbitrary commands via uploading a crafted zip file.

Deeper analysisAI

CVE-2025-69770 is a zip slip vulnerability (CWE-22) affecting the /DesignTools/SkinList.aspx endpoint in MojoPortal CMS version 2.9.0.1. It enables attackers to execute arbitrary commands by uploading a specially crafted zip file. The vulnerability carries a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low attack complexity, lack of required privileges or user interaction, and potential for high impact across confidentiality, integrity, and availability with a change in scope.

Unauthenticated remote attackers can exploit this vulnerability over the network by submitting a malicious zip file to the affected endpoint. Successful exploitation allows arbitrary command execution on the server, potentially leading to full system compromise, data theft, or further lateral movement within the environment.

Advisories and release notes, available at the MojoPortal GitHub security page (https://github.com/i7MEDIA/mojoportal/security), a detailed writeup (https://github.com/kid-tnt/Mojo-check/blob/main/Zipslip%20in%20MojoPortal%20version%202.9.0.1.md), and the v2.9.1 release page (https://www.mojoportal.com/mojoportal-2-9-1), recommend updating to MojoPortal CMS version 2.9.1 or later to mitigate the issue.