CVE-2025-60790: Processwire

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

ProcessWire CMS 3.0.246 allows a low-privileged user with lang-edit to upload a crafted ZIP to Language Support that is auto-extracted without limits prior to validation, enabling resource-exhaustion Denial of Service.

Affected products

• Processwire Processwire: up to and including 3.0.246

Published 2025-10-21. Last modified 2026-06-17.