CVE-2025-34060 | A PHP objection injection vulnerability exists in the Monero… | CVSS 10.0 CRITICAL

Description

A PHP objection injection vulnerability exists in the Monero Project’s Laravel-based forum software due to unsafe handling of untrusted input in the /get/image/ endpoint. The application passes a user-supplied link parameter directly to file_get_contents() without validation. MIME type checks using PHP’s finfo can be bypassed via crafted stream filter chains that prepend spoofed headers, allowing access to internal Laravel configuration files. An attacker can extract the APP_KEY from config/app.php, forge encrypted cookies, and trigger unsafe unserialize() calls, leading to reliable remote code execution.

Metadata

CVE ID: CVE-2025-34060
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2025-04-15 19:15 UTC
Published: 2025-07-01 14:49 UTC
Last updated: 2025-07-01 18:41 UTC
Primary CWE: CWE-502
CWE-502 Deserialization of Untrusted Data
Vendor / Product: Monero Project / Forum
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
Monero Project	Forum	—	—

Weakness (CWE)

CWE	Source	Description
CWE-20	cna	CWE-20 Improper Input Validation
CWE-502	cna	CWE-502 Deserialization of Untrusted Data
CWE-829	cna	CWE-829 Inclusion of Functionality from Untrusted Control Sphere

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References (2)