What is GHSA-8xfq-7f6m-mpmf?

GHSA-8xfq-7f6m-mpmf is a security advisory published by GitHub Security Advisories with Medium severity. MoonShine Arbitrary File Upload Vulnerability

Which CVE IDs does GHSA-8xfq-7f6m-mpmf cover?

GHSA-8xfq-7f6m-mpmf covers the following CVE IDs: CVE-2025-51489. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-8xfq-7f6m-mpmf?

GHSA-8xfq-7f6m-mpmf has a CVSS v3 base score of 4.5, published by GitHub Security Advisories.

Which products are affected by GHSA-8xfq-7f6m-mpmf?

GHSA-8xfq-7f6m-mpmf affects 1 product, including: composer/moonshine/moonshine:\u003c 3.12.5.

GHSA-8xfq-7f6m-mpmfMediumCVSS 4.5

MoonShine Arbitrary File Upload Vulnerability

Vendor

GitHub Security Advisories

Published

August 19, 2025

Last Modified

August 21, 2025

🔗 CVE IDs covered (1)

CVE-2025-51489 →

📋 Description

An arbitrary file upload vulnerability in MoonShine v3.12.4 allows attackers to execute arbitrary code via uploading a crafted SVG file.

🎯 Affected products1

composer/moonshine/moonshine:< 3.12.5

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2025-51489
https://github.com/GiacoLenzo2109/MoonShine_Software_PoCs
https://github.com/moonshine-software/moonshine/commit/7102fb113627870fb1cb7176e1d0d95bb47a7fd4
https://github.com/advisories/GHSA-8xfq-7f6m-mpmf