{"id":"GHSA-5pm9-r2m8-rcmj","summary":"Paymenter vulnerable to Remote Code Execution via public file uploads","details":"### Impact\n\nThe ticket attachments functionality in Paymenter allows a malicious authenticated user to upload arbitrary files.\n\nWith the ability to execute arbitrary code, this vulnerability can be exploited in numerous ways, including but not limited to:\n- Extracting sensitive data from the database (e.g. customer information).\n- Reading credentials from .env or other configuration files.\n- Running arbitrary system commands under the web server user context.\n\nThis issue is Critical as it allows a low-privilege authenticated user to fully compromise the application and underlying server.\n\n### Patches\nThis vulnerability was patched by https://github.com/Paymenter/Paymenter/commit/87c3db42282ada1e3cda54b9a01f846926c0669b and was released under the [v1.2.11](https://github.com/Paymenter/Paymenter/releases/tag/v1.2.11) tag without any other code modifications compared to v1.2.10.\n\n### Work arounds\nIf upgrading is not immediately possible, administrators can mitigate this vulnerability with one or more of the following measures:\n\n- Updating nginx config to download attachments instead of executing them:\n```\nlocation ^~ /storage/ {\n    types { }\n    default_type application/octet-stream;\n    add_header X-Content-Type-Options nosniff;\n    try_files $uri =404;\n}\n```\n- Disallow access to /storage/ fully using a WAF such as Cloudflare\n\nThese workarounds significantly reduce risk, but the only guaranteed resolution is upgrading to v1.2.11 or later.","aliases":["CVE-2025-58048"],"modified":"2026-09-10T03:51:07.864283412Z","published":"2026-06-22T16:53:59Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-06-22T16:53:59Z","nvd_published_at":"2025-08-28T18:15:33Z","cwe_ids":["CWE-434"],"severity":"CRITICAL"},"references":[{"type":"WEB","url":"https://github.com/Paymenter/Paymenter/security/advisories/GHSA-5pm9-r2m8-rcmj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58048"},{"type":"WEB","url":"https://github.com/Paymenter/Paymenter/commit/87c3db42282ada1e3cda54b9a01f846926c0669b"},{"type":"PACKAGE","url":"https://github.com/Paymenter/Paymenter"},{"type":"WEB","url":"https://github.com/Paymenter/Paymenter/releases/tag/v1.2.11"}],"affected":[{"package":{"name":"paymenter/paymenter","ecosystem":"Packagist","purl":"pkg:composer/paymenter/paymenter"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.11"}]}],"versions":["0.1","0.1.1","0.1.2","0.1.3","0.2","0.2.1","v0.3","v0.4","v0.4.1","v0.5","v0.5.1","v0.5.2","v0.5.3","v0.6","v0.7","v0.7.1","v0.8","v0.8.1","v0.8.2","v0.9","v0.9.1","v0.9.2","v0.9.3","v0.9.4","v0.9.5","v1.0.0","v1.0.1","v1.0.2","v1.0.3","v1.0.4","v1.1.0","v1.1.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5pm9-r2m8-rcmj/GHSA-5pm9-r2m8-rcmj.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}