Description
ChanCMS在特定接口存在用户可控的参数，无需任何黑名单/白名单过滤或特殊字符转义安全措施，允许攻击者执行任意 javascript 代码。
ChanCMS 存在远程命令执行漏洞（CVE-2025-8266）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-8266
https://github.com/advisories/GHSA-pg2f-hfwm-m7g5
https://vulners.com/cve/CVE-2025-8266
https://vuldb.com/?id.317857
https://access.redhat.com/security/cve/cve-2025-8266
https://avd.aliyun.com/high-risk/list?page=2
https://blog.csdn.net/m0_50125527/article/details/150412965
https://pentest-tools.com/vulnerabilities-exploits/chancms-31-remote-code-execution_28843