RCE in Vaelsys
CVE-2025-8259
A vulnerability was identified in Vaelsys VaelsysV4 up to 5.1.0/5.4.0. Affected by this issue is the function execute_DataObjectProc of the file /grid/vgrid_server.php of the component Web interface. Such manipulation of the argument xajaxargs leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. Upgrading to version 5.1.1 and 5.4.1 can resolve this issue. It is suggested to upgrade the affected component.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.032 (87.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.
Affected products
- Vaelsys — versions 4.1.0
- Vaelsys Vaelsysv4 — versions 5.0, 5.1, 5.1.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cna@vuldb.com (technical-description, vdb-entry)
- cna@vuldb.com (signature, permissions-required)
- cna@vuldb.com (third-party-advisory)
- cna@vuldb.com (Exploit, Third Party Advisory, exploit)
- cna@vuldb.com (patch)
Frequently asked questions
- What is CVE-2025-8259?
- CVE-2025-8259 is a high-severity vulnerability in Vaelsys, classified under Command Injection. CVSS score: 7.3/10. Published 2025-07-28.
- How severe is CVE-2025-8259?
- High severity. CVSS v3 base score is 7.3 out of 10.
- Is CVE-2025-8259 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.