CVE-2025-2978 is a medium severity (CVSS 6.3) unrestricted file upload in WCMS 11. The article publishing page's upload handler, used with the CKEditor integration, does not restrict files enough. The record says the vendor did not respond, so no fix is confirmed.
What's affected
The record lists WCMS 11 as affected, in the article publishing page upload feature (the CKEditor upload path under /index.php).
The record also states that the vendor was contacted early about the disclosure but did not respond in any way. No fixed version is named and I found none in the record. You should treat the product as unpatched.
The exploit was disclosed publicly, according to the record. It is not reported as exploited in the wild, and the CVE is not in the CISA KEV catalog.
How to check if you're exposed
Check which version of WCMS your site runs. If it is 11, assume exposure.
- Look in the web server access log for requests that contain the article admin upload path and the CKEditor parameters.
- List the upload folders used by the editor and look for files that are not images or documents you recognize.
- Check whether the article admin area requires login, and who can reach it from the network.
If you see unexpected files, preserve them and start your incident process.
What to do now
- List every site that uses WCMS 11 and decide whether it needs to stay online.
- Limit the article admin area to trusted networks or require a VPN.
- Disable the editor upload feature if editors do not need it, or enforce a short allow list of file types.
- Make sure the upload directory cannot execute scripts.
- Plan to migrate to a maintained content management system, since the vendor has not responded.
Why it matters
The record lists CWE-434 (Unrestricted Upload of File with Dangerous Type) and CWE-284 (Improper Access Control). Editor upload endpoints are a common place for this bug because they are built to accept files from a browser and are easy to forget during hardening.
When the vendor does not respond, defenders lose the usual fix path. That makes layered controls more important: restrict who can reach the endpoint, limit what file types can be stored, and keep stored files from being executed. Monitoring for new files in upload directories is a cheap way to notice trouble early.
A medium score does not capture the full outcome of a successful upload on a site where the web server account has wide access, so check that account's permissions as well.
Quick check
What if the vendor never ships a patch?
Reduce exposure with network limits and server hardening, and plan to replace the product. Unmaintained software accumulates risk.
Does the record say this is exploited?
No. It says the exploit was disclosed publicly. Public disclosure does raise the chance of attempts.
Sources
Last reviewed: 19 October 2026.
