CVE-2025-25791 describes an arbitrary file upload vulnerability in YZNCMS v2.0.1. The issue exists in the plugin installation functionality, where an attacker with low privileges can upload a specially crafted Zip archive. This can result in execution of arbitrary code on the affected system. The vulnerability is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command). The CVSS v3.1 base score is 4.4, reflecting a medium impact with local attack vector, low complexity, and no user interaction required. There is no vendor advisory or patch information available at this time.

Successful exploitation could allow an attacker with limited privileges to execute arbitrary code on the affected system by uploading a malicious Zip file via the plugin installation feature. This may lead to partial confidentiality and integrity loss but does not affect availability. The attack requires local access or equivalent privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin installation feature to trusted users only and monitor for suspicious activity related to file uploads. Avoid uploading untrusted plugin packages.