CVE-2025-1113 is a medium severity (6.3) insecure deserialization flaw in taisan tarzan-cms up to 1.0.0. The upload function of the Add Theme Handler in the admin area is affected. The record lists no fixed version, so limit access to the admin area and check the project for a patched release.
What's affected
The record lists taisan tarzan-cms up to and including 1.0.0. The affected function is upload, in the Add Theme Handler under the admin themes page. CVSS 6.3 (medium severity), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. The record notes the issue was reported as critical by its source, while the score here is medium.
Fixed versions: none are named in the record.
How to check if you're exposed
First find out whether you run it at all. Search your asset list, container images and web roots for taisan tarzan-cms. On a Linux host you can look for the vulnerable file name directly.
find / -name "upload" -not -path "/proc/*" 2>/dev/null
Check which theme files were added through the admin area and when. Review admin login history, since the affected function sits behind the admin themes page. Compare the theme directory with your last known good copy.
A dependency scan helps with the inventory part. The free in-browser scan at gold.safeguard.sh/scan lists the libraries in a manifest you paste in. It will not find a hobby PHP application that was never packaged, so keep a plain list of what you host too.
What to do now
- Limit the admin area to trusted addresses and strong credentials.
- Check the project page for a newer release than 1.0.0 and read its changelog.
- Do not upload theme packages from sources you do not control.
- Review the theme directory against a known good copy.
- If the CMS is not essential, consider moving to a maintained platform.
Why it matters
The record classes this as CWE-20 (improper input validation), CWE-502 (deserialization of untrusted data). Deserialization turns stored bytes back into objects. If the bytes come from an untrusted source, the application can be tricked into building objects that do things the developer never planned.
The score is medium, partly because the vector asks for privileges, which here means access to the admin area. That is not a reason to ignore it, since admin accounts are often shared or weakly protected. The record does not mark it as on CISA KEV.
Quick check
Is there a patched version?
The CVE record names none. Check the project page for a newer release.
Why is deserialization risky?
Rebuilding objects from untrusted data can trigger code paths the developer never meant to expose. Avoid it for untrusted input, or restrict allowed types.
Sources
Last reviewed: 19 October 2026.
