CVE-2025-60731 describes a file upload vulnerability in PerfreeBlog v4.0.11 specifically within the installTheme function. The vulnerability allows an attacker with low privileges to upload files remotely without requiring user interaction. The CVSS 3.1 base score is 7.6, reflecting a high severity with network attack vector, low attack complexity, and no user interaction required. The impact includes high confidentiality loss, low integrity loss, and low availability loss. No official patch or remediation information is currently available.

An attacker with low privileges can exploit this vulnerability remotely to upload arbitrary files, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact). The integrity and availability impacts are rated low, indicating limited modification or disruption capabilities. Exploitation could facilitate further attacks depending on the uploaded file's nature.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the installTheme function and monitor for suspicious file uploads. Apply strict validation and sanitization of uploaded files if possible.