{"id":"GHSA-9p44-q66p-xm6p","aliases":["CVE-2025-60790"],"title":"ProcessWire CMS vulnerable to resource-exhaustion Denial of Service","description":"ProcessWire CMS 3.0.246 allows a low-privileged user with lang-edit to upload a crafted ZIP to Language Support that is auto-extracted without limits prior to validation, enabling resource-exhaustion Denial of Service.","severity":"medium","score":5.7,"published":"2025-10-21T18:30:35.000Z","modified":"2025-10-27T20:21:46.981Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"processwire/processwire","ranges":[{"events":[{"introduced":"0"},{"last_affected":"3.0.246"}],"type":"ECOSYSTEM"}],"versions":["3.0.123","3.0.148","3.0.164","3.0.165","3.0.184","3.0.200","3.0.210","3.0.226","3.0.227","3.0.244","3.0.246","3.0.34","3.0.35","3.0.36","3.0.39","3.0.41","3.0.42","3.0.61","3.0.62","3.0.96","3.0.98"],"fixed":[]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2025-60790","https://github.com/processwire/processwire-issues/issues/2120","https://github.com/NomanProdhan/security-vulnerability-research/tree/master/CVE-2025-60790","https://github.com/processwire/processwire"],"sources":[{"name":"OSV","id":"GHSA-9p44-q66p-xm6p","modified":"2025-10-27T20:21:46.981895Z","url":"https://osv.dev/vulnerability/GHSA-9p44-q66p-xm6p"}],"assessments":[{"source":"OSV","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","score":5.7}]}