Description
LeptonCMS version 7.3.0 contains an arbitrary file upload vulnerability, which is caused by the lack of proper validation for uploaded files. An authenticated attacker can exploit this vulnerability by uploading a specially crafted ZIP/PHP file to execute arbitrary code.
Affected products
lepton-cms: leptoncms
References3
- github.com/Kayi626/Vulns/blob/UserAccount/LEPTON_CMS_7.3.0_File… ExploitThird Party Advisory
- github.com/Kayi626/Vulns/blob/UserAccount/LEPTON_CMS_7.3.0_File… ExploitThird Party Advisory
- github.com/Kayi626/Vulns/blob/UserAccount/LEPTON_CMS_7.3.0_File… ExploitThird Party Advisory
Metrics
- CVSS 3.1
-
8.8
HIGH
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 1% percentile: 58 · as of 11 November 2026
- CWE
- CWE-434
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.