CVE-2025-56704 affects LeptonCMS version 7.3.0 and involves an arbitrary file upload vulnerability caused by improper validation of uploaded files. Authenticated attackers can upload specially crafted ZIP or PHP files, leading to remote code execution. The vulnerability is rated high severity with a CVSS 3.1 score of 8.8, indicating network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and no known exploits are reported in the wild.

Successful exploitation allows an authenticated attacker to execute arbitrary code on the affected system, potentially leading to full system compromise, data theft, or service disruption. The vulnerability impacts confidentiality, integrity, and availability at a high level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict file upload permissions and monitor for suspicious file uploads. Avoid granting unnecessary privileges to users who can upload files.