CVE-2022-25581: Classcms

High severity, CVSS 7.8. EPSS: 1.2% chance of exploitation in the next 30 days.

Classcms v2.5 and below contains an arbitrary file upload via the component \class\classupload. This vulnerability allows attackers to execute code injection via a crafted .txt file.

Affected products

• Classcms Classcms: up to and including 2.5

Published 2022-03-18. Last modified 2026-06-17.