CVE-2025-29306: FoxCMS index.html case display page code injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with no authentication or interaction required and a public exploit reference makes this a critical pre-auth RCE risk.

What it is

FoxCMS 1.2.5 contains a code injection flaw (CWE-94) reachable through the case display page in the index.html component, allowing a remote attacker to execute arbitrary code. With a CVSS 3.1 score of 9.8 and no privileges or user interaction required, this is a severe pre-auth remote code execution risk for exposed installations.

Impact

An unauthenticated remote attacker can execute arbitrary code on the server, leading to full compromise of confidentiality, integrity and availability of the FoxCMS host and any data it serves.

Attack surface

Reached over the network via the case display page in the index.html component; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are needed.

Exploitation

Not listed in CISA KEV, but EPSS is 0.46583 (98.8th percentile) and a public exploit reference exists on GitHub, indicating meaningful and elevated exploitation likelihood.

What to do

• Apply the vendor fix for FoxCMS 1.2.5 or upgrade to a patched release as soon as one is available; if no patch exists, restrict or disable the case display page.
• Place FoxCMS behind a WAF or reverse proxy with rules blocking code-injection patterns targeting the index.html case display endpoint.
• Remove or restrict public internet exposure of FoxCMS administrative and content pages until patched.
• Run the web service with least privilege and isolate it from sensitive internal systems to limit post-exploitation reach.

Detection

• Monitor web logs for suspicious requests to the index.html case display page containing code or template injection payloads.
• Alert on unexpected child processes spawned by the web server (e.g., shell, curl, wget) indicating code execution.
• Review file integrity on FoxCMS web directories for newly written or modified files after page requests.
• Correlate outbound network connections from the FoxCMS host with inbound requests to the vulnerable page.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.