CVE-2025-25784 describes an arbitrary file upload vulnerability in Jizhicms v2.5.4 within the \c\TemplateController.php component. Attackers can exploit this flaw by uploading a specially crafted Zip file, which results in the execution of arbitrary code on the affected system. This vulnerability is remotely exploitable without authentication and requires no user interaction. The CVSS v3.1 base score is 9.8, reflecting its critical severity and potential for full system compromise. No official patch or remediation guidance is currently available from the vendor, and no known public exploits have been reported.

Successful exploitation allows remote attackers to execute arbitrary code on the affected system, potentially leading to full system compromise including unauthorized access, data modification, and service disruption. The vulnerability affects confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected component and monitor for suspicious file upload activity. Avoid deploying Jizhicms v2.5.4 in untrusted environments or expose it to untrusted users. Implement additional security controls such as web application firewalls to detect and block malicious uploads.