CVE-2025-11905 | yanyutao0402 ChanCMS up to 3.3.2 gather.js getArticle code injection

A vulnerability described as critical has been identified in yanyutao0402 ChanCMS up to 3.3.2. This vulnerability affects the function getArticle of the file appmodulescmscontrollergather.js. The manipulation results in code injection.

This vulnerability is cataloged as CVE-2025-11905. The attack may be launched remotely. Furthermore, there is an exploit available.

The vendor was contacted early about this disclosure but did not respond in any way.