CVE-2025-1113

taisan tarzan-cms Add Theme admin#themes upload deserialization

Public exploit available. Not confirmed exploited in the wild yet. No fix published yet.

CVSS 3.16.3Medium EPSS percentile43rd0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 1 source FixNone yetNo fix or workaround published

Published 2025-02-07Updated 2025-08-21Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether you run tarzan-cms and whether its version is 1.0.0 or earlier.
Restrict administrator accounts to trusted staff, remove unused accounts, and require strong unique passwords.
Do not allow untrusted users to upload themes; review recent theme uploads and administrator activity for anything unexpected.
Contact the vendor or maintainer for a fixed release, because no patch or fixed version is currently available.
If you cannot control administrator access, take the affected site out of public service until you can.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A vulnerability was found in taisan tarzan-cms up to 1.0.0. It has been rated as critical. This issue affects the function upload of the file /admin#themes of the component Add Theme Handler. The manipulation leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

In plain language

Written by AI from the record

Tarzan CMS versions up to 1.0.0 have a theme-upload flaw that a logged-in attacker may use to interfere with the site, so affected businesses should address it soon.

Authenticated remote deserialization through the Add Theme upload handler at /admin#themes can compromise confidentiality, integrity, and availability in tarzan-cms.

If you're affected

Website administration compromise
Site content changes
Service disruption
Sensitive site data exposure

What is it

This is a flaw in the part of Tarzan CMS used to add a website theme. It is like accepting a sealed package from someone with a building key and automatically carrying out whatever instructions are inside, instead of checking that the package is safe.

Who is affected

This matters to you if you run tarzan-cms, especially if staff use its administrator area to add themes. It is only a risk to someone who already has a valid login with access to the theme-upload function.

How urgent is it

A public exploit is available, meaning the instructions needed to abuse this weakness are not private. Treat this as an amber priority: promptly limit access to the administrator area and theme uploads while waiting for a vendor fix, but there is no confirmed evidence of widespread active attacks.

What to do — in detail

Confirm the installed tarzan-cms version and identify every deployment, including staging systems that are internet-accessible. Versions up to and including 1.0.0 are affected; no fixed version or supported upgrade path has been published.

Until a patch is available, restrict access to the administration interface and specifically to theme uploads using trusted accounts and network controls. Disable or remove theme-upload access for accounts that do not need it, review administrator accounts for unexpected additions, and inspect recent theme uploads for unapproved files or changes.

There is no CISA KEV remediation due date because this CVE is not listed in KEV. Watch the project’s official release channel for a fixed version, then test and deploy that release promptly. Monitor authentication events, administrator-account changes, theme upload activity, and unexpected site-file or content changes.

Technical context

CVSS v3.1 is 6.3 (Medium): AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. The reported weakness is CWE-20 improper input validation and CWE-502 deserialization of untrusted data, affecting the Add Theme Handler upload function at /admin#themes in tarzan-cms through 1.0.0. A public exploit is available. CISA KEV does not list the CVE; EPSS predicts 0.5% likelihood (43rd percentile) with a flat trend. Press attention is rising, but that does not establish active exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS43rd

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 43rd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

5 events over 393 days, from the signal feeds we watch.

2026-03-07Public exploit / PoCsource: other
2025-08-21Record updated
2025-02-07Publishedweakness classified, att&ck mapped

Affected products

taisancommercial
- tarzan-cmsOn-premWeb & CMS Plugins / wordpress-plugin

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Scored 6.3 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality LowSome restricted information is disclosed, but limited in scope
Integrity LowData modification is possible but limited in scope or consequence
Availability LowReduced performance or intermittent disruption of service

Weaknesses

ATT&CK techniques

Mapped from the weaknesses above (CWE to ATT&CK), not observed in attacks.

Sources

References in the record

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Tarzan-cms, not every advisory. This one: public exploit.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account