CVE-2025-58048: Paymenter/paymenter Remote Code Execution Vulnerability
CRITICALCVE-2025-58048 is a CRITICAL (CVSS 9.9) remote code execution vulnerability (CWE-434: Unrestricted Upload of File with Dangerous Type) affecting Paymenter/paymenter libraries in the Packagist ecosystem. The issue involves paymenter vulnerable to remote code execution via public file uploads. Remediation is available by upgrading affected packages to version 1.2.11.
CVE-2025-58048 at a Glance
Security Impact
CVSS: 9.9
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
How to Fix CVE-2025-58048
To remediate this vulnerability, upgrade all affected Paymenter/paymenter dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade paymenter/paymenter to 1.2.11Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for paymenter/paymenterHow to Check if You Are Affected
To determine whether your application is affected by CVE-2025-58048, inspect your project dependencies for Paymenter/paymenter:
inspect dependencies for paymenter/paymenterAnalyze the terminal output to locate any version of Paymenter/paymenter in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.2.11), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-434: Unrestricted Upload of File with Dangerous Type, where the product allows the upload or transfer of dangerous file types that are automatically processed within its environment. In Paymenter/paymenter, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2025-58048 Affected Paymenter/paymenter Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
paymenter/paymenter
|
Packagist |
< 1.2.11
|
1.2.11
|
References
Frequently Asked Questions
What is CVE-2025-58048?
Which Paymenter/paymenter versions are affected?
What version fixes CVE-2025-58048?
Is paymenter/paymenter affected?
What is the CVSS score of CVE-2025-58048?
What CWE is associated with CVE-2025-58048?
How can I check Packagist dependencies for CVE-2025-58048?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-5pm9-r2m8-rcmj",
"modified" : "2026-06-22T16:53:59Z",
"published" : "2026-06-22T16:53:59Z",
"aliases" : [ "CVE-2025-58048" ],
"summary" : "Paymenter vulnerable to Remote Code Execution via public file uploads",
"details" : "### Impact\n\nThe ticket attachments functionality in Paymenter allows a malicious authenticated user to upload arbitrary files.\n\nWith the ability to execute arbitrary code, this vulnerability can be exploited in numerous ways, including but not limited to:\n- Extracting sensitive data from the database (e.g. customer information).\n- Reading credentials from .env or other configuration files.\n- Running arbitrary system commands under the web server user context.\n\nThis issue is Critical as it allows a low-privilege authenticated user to fully compromise the application and underlying server.\n\n### Patches\nThis vulnerability was patched by https://github.com/Paymenter/Paymenter/commit/87c3db42282ada1e3cda54b9a01f846926c0669b and was released under the [v1.2.11](https://github.com/Paymenter/Paymenter/releases/tag/v1.2.11) tag without any other code modifications compared to v1.2.10.\n\n### Work arounds\nIf upgrading is not immediately possible, administrators can mitigate this vulnerability with one or more of the following measures:\n\n- Updating nginx config to download attachments instead of executing them:\n```\nlocation ^~ /storage/ {\n types { }\n default_type application/octet-stream;\n add_header X-Content-Type-Options nosniff;\n try_files $uri =404;\n}\n```\n- Disallow access to /storage/ fully using a WAF such as Cloudflare\n\nThese workarounds significantly reduce risk, but the only guaranteed resolution is upgrading to v1.2.11 or later.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Packagist",
"name" : "paymenter/paymenter"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.2.11"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/Paymenter/Paymenter/security/advisories/GHSA-5pm9-r2m8-rcmj"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-58048"
}, {
"type" : "WEB",
"url" : "https://github.com/Paymenter/Paymenter/commit/87c3db42282ada1e3cda54b9a01f846926c0669b"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/Paymenter/Paymenter"
}, {
"type" : "WEB",
"url" : "https://github.com/Paymenter/Paymenter/releases/tag/v1.2.11"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-434" ],
"severity" : "CRITICAL",
"github_reviewed" : true,
"github_reviewed_at" : "2026-06-22T16:53:59Z",
"nvd_published_at" : "2025-08-28T18:15:33Z"
}
}