CVE-2025-70831 Details
Description
A Remote Code Execution (RCE) vulnerability was found in Smanga 3.2.7 in the /php/path/rescan.php interface. The application fails to properly sanitize user-supplied input in the mediaId parameter before using it in a system shell command. This allows an unauthenticated attacker to inject arbitrary operating system commands, leading to complete server compromise.
A remote code execution vulnerability has been identified in Smanga version 3.2.7, specifically within the '/php/path/rescan.php' interface. The issue arises because the application does not adequately sanitize user input in the 'mediaId' parameter before incorporating it into a system shell command. This flaw enables an unauthenticated attacker to inject arbitrary operating system commands, potentially leading to complete server compromise.
The vulnerability can be addressed by properly sanitizing user input before it is used in shell commands, such as by using 'escapeshellarg()' to escape command injection characters.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/LX-66-LX/cve/issues/5 | [email protected] | Broken Link |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| lkw199711 smanga | 3.2.7 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 26, 2026 | Initial Analysis | [email protected] |
| Feb 23, 2026 | CVE Modified | CISA-ADP |
| Feb 20, 2026 | New CVE Received | [email protected] |