Can CVE-2025-55182 (React Server Components Vulnerability) Create Files Like .sh, .gz, or XMRig Miners in Server Root?

Source: Dev.to

Question

I am running a Next.js project (using React Server Components) with Magento 2 as backend.

Recently, my server was compromised and I found suspicious files in my root, including:

• .sh shell scripts
• .gz or .tar.gz archives
• an XMRig miner binary
• auto‑restart scripts

While investigating, I came across CVE‑2025‑55182, which affects React Server Components and allows certain internal component source code to be exposed.

My main question:

• Can CVE‑2025‑55182 or any React Server Component vulnerability allow an attacker to:
  • write files to the server filesystem,
  • upload .sh or .gz files,
  • execute shell scripts,
  • or deploy binaries like XMRig?

Or is this vulnerability limited only to leaking component code and cannot lead to remote code execution or file creation, meaning the server compromise must have happened from another source (e.g., Magento exploit, SSH compromise, misconfigured permissions, etc.)?

I want to confirm whether this CVE could be responsible for the filesystem‑level changes, or if I should look elsewhere for the root cause.