CVE-2025-67718 json
Formio improperly authorized permission elevation through specially crafted request path
published 2025-12-10 10 mo ago modified 2026-10-14 25 d ago also EUVD-2025-202594 , GHSA-m654-769v-qjv7
- cvss
- 8.7
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 24%
- public exploits
- 0
- none known
Summary
Form.io is a combined Form and API platform for Serverless applications. Versions 3.5.6 and below and 4.0.0-rc.1 through 4.4.2 contain a flaw in path handling which could allow an attacker to access protected API endpoints by sending a crafted request path. An unauthenticated or unauthorized request could retrieve data from endpoints that should be protected. This issue is fixed in versions 3.5.7 and 4.4.3.
Patch / fix
- npm formio 3.5.7, 4.4.3
- form form.io 3.5.7, 4.4.3
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 10 mo ago
Exploit prediction
0.31% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | formio | <3.5.7 >=4.0.0-rc.1, <4.4.3 |
3.5.7 4.4.3 |
Affected products
- formio formio
Classification
References
-
github.com
/formio/formio/commit/1836bdd9f55f5888ff397c257b2108c09d3de478
web
-
github.com
/formio/formio/commit/1665b7c99e3cf3246db7ff0b4ff732231dc6903b
web
-
github.com
/formio/formio/security/advisories/GHSA-m654-769v-qjv7
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-67718
advisory
-
github.com
/formio/formio
package
Sources
- CVE List CVE-2025-67718
- GitHub Advisory GHSA-m654-769v-qjv7
- NVD CVE-2025-67718
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.