CVE-2025-15393 | Kohana KodiCMS up to 13.82.135 Layout API Endpoint file.php save content code injection

A vulnerability marked as critical has been reported in Kohana KodiCMS up to 13.82.135. This impacts the function Save of the file cms/modules/kodicms/classes/kodicms/model/file.php of the component Layout API Endpoint. The manipulation of the argument content leads to code injection.

This vulnerability is documented as CVE-2025-15393. The attack can be initiated remotely. Additionally, an exploit exists.

The vendor was contacted early about this disclosure but did not respond in any way.