CVE-2025-58047 json
Volto affected by possible DoS by invoking specific URL by anonymous user
published 2025-08-28 14 mo ago modified 2026-09-26 44 d ago also EUVD-2025-26139 , GHSA-xjhf-7833-3pm5
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 52%
- public exploits
- 0
- none known
Summary
Volto is a React based frontend for the Plone Content Management System. In versions from 19.0.0-alpha.1 to before 19.0.0-alpha.4, 18.0.0 to before 18.24.0, 17.0.0 to before 17.22.1, and prior to 16.34.0, an anonymous user could cause the NodeJS server part of Volto to quit with an error when visiting a specific URL. The problem has been patched in versions 16.34.0, 17.22.1, 18.24.0, and 19.0.0-alpha.4. To mitigate downtime, have setup automatically restart processes that quit with an error.
Patch / fix
- npm @plone/volto 16.34.0, 17.22.1, 18.24.0, 19.0.0-alpha.4
- plone volto 16.34.0, 17.22.1, 18.24.0, 19.0.0-alpha.4
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 14 mo ago
Exploit prediction
0.67% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @plone/volto | <16.34.0 >=17.0.0, <17.22.1 >=18.0.0, <18.24.0 >=19.0.0-alpha.1, <19.0.0-alpha.4 |
16.34.0 17.22.1 18.24.0 19.0.0-alpha.4 |
Affected products
- plone volto
Classification
- Weakness
-
- CWE-755 Improper Handling of Exceptional Conditions
References
-
github.com
/plone/volto/commit/2789a287ac45ad9039fb9161d465ba13241fff0a
web
-
github.com
/plone/volto/security/advisories/GHSA-xjhf-7833-3pm5
web
-
github.com
/plone/volto/releases/tag/16.34.0
web
-
github.com
/plone/volto/releases/tag/17.22.1
web
-
github.com
/plone/volto/releases/tag/18.24.0
web
-
github.com
/plone/volto/releases/tag/19.0.0-alpha.4
web
-
openwall.com
/lists/oss-security/2025/08/28/3
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-58047
advisory
-
github.com
/plone/volto
package
Sources
- CVE List CVE-2025-58047
- GitHub Advisory GHSA-xjhf-7833-3pm5
- NVD CVE-2025-58047
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.