> CVE-2025-61668

« BACK_TO_HOME
PUBLISHED
2025-10-02 22:15
MODIFIED
2025-10-06 14:57
EPSS (Prob. Exploit)
0.44%
Top 63.0%
DATA SOURCES:
NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-11-04 OSV 🔗 2026-11-01

> DESCRIPTION

Volto is a ReactJS-based frontend for the Plone Content Management System. Versions 16.34.0 and below, 17.0.0 through 17.22.1, 18.0.0 through 18.27.1, and 19.0.0-alpha.1 through 19.0.0-alpha.5, an anonymous user could cause the NodeJS server part of Volto to quit with an error when visiting a specific URL. This issue is fixed in versions 16.34.1, 17.22.2, 18.27.2 and 19.0.0-alpha.6.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-m8rj-ppph-mj33 HIGH

@plone/volto vulnerable to potential DoS by invoking specific URL by anonymous user

AFFECTED PACKAGES:
NPM / @plone/volto
>= 19.0.0-alpha.1, < 19.0.0-alpha.6
Fixed in: 19.0.0-alpha.6
NPM / @plone/volto
>= 18.0.0, < 18.27.2
Fixed in: 18.27.2
NPM / @plone/volto
>= 17.0.0, < 17.22.2
Fixed in: 17.22.2
NPM / @plone/volto
< 16.34.1
Fixed in: 16.34.1

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

@plone/volto vulnerable to potential DoS by invoking specific URL by anonymous user

AFFECTED PACKAGES:
Unknown / Unknown
729 versions affected
ALIASES:
GHSA-m8rj-ppph-mj33

> HISTORIQUE DES MODIFICATIONS

Première apparition
02/10/2025 22:15
Source: NVD
📊 ENRICHISSEMENT 18/10/2025 15:08
CVEPROJECT
Champ modifié: CVE Project
Ancienne valeur:
Non
Nouvelle valeur:
Oui
Total des modifications: 1 Dernière mise à jour: 1 year ago
« BACK_TO_HOME