CVE-2025-61668
- Source
- https://cve.org/CVERecord?id=CVE-2025-61668
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-61668.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-61668
- Aliases
- Published
- 2025-10-02T21:46:32.975Z
- Modified
- 2026-07-15T01:48:51.505357153Z
- Severity
-
- 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- @plone/volto vulnerable to potential DoS by invoking specific URL by anonymous user
- Details
-
Volto is a ReactJS-based frontend for the Plone Content Management System. Versions 16.34.0 and below, 17.0.0 through 17.22.1, 18.0.0 through 18.27.1, and 19.0.0-alpha.1 through 19.0.0-alpha.5, an anonymous user could cause the NodeJS server part of Volto to quit with an error when visiting a specific URL. This issue is fixed in versions 16.34.1, 17.22.2, 18.27.2 and 19.0.0-alpha.6.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61668.json", "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-476", "CWE-754" ] }- References
-
- http://github.com/plone/volto/releases/tag/18.27.2
- https://github.com/plone/volto/releases/tag/16.34.1
- https://github.com/plone/volto/releases/tag/17.22.2
- https://github.com/plone/volto/releases/tag/19.0.0-alpha.6
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61668.json
- https://github.com/plone/volto/security/advisories/GHSA-m8rj-ppph-mj33
- https://nvd.nist.gov/vuln/detail/CVE-2025-61668
- https://github.com/plone/volto/commit/58d9f82d2d50ca9a87edbe16fed91762e57c109c
- https://github.com/plone/volto/pull/7412
- https://github.com/plone/volto/pull/7413
Affected packages
Git / github.com/plone/volto
Affected ranges
- Type
- GIT
- Repo
- https://github.com/plone/volto
- Events
-
IntroducedFixedIntroducedFixedIntroducedFixedFixedFixedFixedFixedFixed
- Database specific
{ "source": [ "DESCRIPTION", "REFERENCES" ], "extracted_events": [ { "introduced": "17.0.0" }, { "fixed": "17.22.1" }, { "introduced": "18.0.0" }, { "fixed": "18.27.1" }, { "introduced": "19.0.0-alpha.1" }, { "fixed": "19.0.0-alpha.5" } ] }
Affected versions
17.*
17.0.0
17.0.1
17.1.0
17.1.1
17.10.0
17.11.0
17.11.1
17.11.2
17.11.3
17.11.4
17.11.5
17.12.0
17.12.1
17.13.0
17.14.0
17.15.0
17.15.1
17.15.2
17.15.3
17.15.4
17.15.5
17.15.6
17.16.0
17.16.1
17.16.2
17.17.0
17.18.0
17.18.1
17.18.2
17.19.0
17.2.0
17.20.0
17.20.1
17.20.2
17.20.3
17.20.4
17.21.0
17.22.0
17.22.1
17.3.0
17.4.0
17.5.0
17.6.0
17.6.1
17.7.0
17.8.0
17.9.0
18.*
18.0.0
18.0.1
18.0.2
18.0.3
18.1.0
18.1.1
18.1.2
18.10.0
18.10.1
18.11.0
18.11.1
18.12.0
18.12.1
18.13.0
18.14.0
18.14.1
18.15.0
18.15.1
18.16.0
18.17.0
18.18.0
18.19.0
18.2.0
18.2.1
18.2.2
18.2.3
18.20.0
18.21.0
18.22.0
18.23.0
18.24.0
18.25.0
18.26.0
18.27.0
18.27.1
18.3.0
18.4.0
18.5.0
18.6.0
18.7.0
18.8.0
18.8.1
18.8.2
18.9.0
18.9.1
18.9.2
19.*
19.0.0-alpha.1
19.0.0-alpha.2
19.0.0-alpha.3
19.0.0-alpha.4
19.0.0-alpha.5
19.0.0-alpha.6
generator-volto-7.*
generator-volto-7.0.0
generator-volto-7.0.1
generator-volto-8.*
generator-volto-8.1.0
generator-volto-8.1.1
generator-volto-8.1.2
generator-volto-8.1.3
generator-volto-8.1.4
generator-volto-9.*
generator-volto-9.0.0
generator-volto-9.0.1
plone-blocks-1.*
plone-blocks-1.0.0-alpha.2
plone-blocks-1.0.0-alpha.3
plone-client-1.*
plone-client-1.0.0-alpha.20
plone-client-1.0.0-alpha.21
plone-client-1.0.0-alpha.22
plone-client-1.0.0-alpha.23
plone-components-2.*
plone-components-2.1.0
plone-components-2.1.1
plone-components-2.2.0
plone-components-2.2.1
plone-components-3.*
plone-components-3.0.0
plone-components-3.0.1
plone-components-3.0.2
plone-helpers-1.*
plone-helpers-1.0.0
plone-helpers-1.0.1
plone-helpers-1.0.2
plone-providers-1.*
plone-providers-1.0.0-alpha.4
plone-providers-1.0.0-alpha.5
plone-providers-1.0.0-alpha.6
plone-providers-1.0.0-alpha.7
plone-providers-1.0.0-alpha.8
plone-react-router-1.*
plone-react-router-1.0.0
plone-react-router-1.0.1
plone-registry-2.*
plone-registry-2.1.0
plone-registry-2.1.1
plone-registry-2.1.2
plone-registry-2.2.0
plone-registry-2.3.0
plone-registry-2.4.0
plone-registry-2.4.1
plone-registry-2.5.0
plone-registry-2.5.1
plone-registry-2.5.2
plone-registry-2.5.3
plone-registry-2.5.4
plone-registry-3.*
plone-registry-3.0.0-alpha.4
plone-registry-3.0.0-alpha.5
plone-registry-3.0.0-alpha.6
plone-scripts-3.*
plone-scripts-3.0.1
plone-scripts-3.10.0
plone-scripts-3.10.1
plone-scripts-3.10.2
plone-scripts-3.8.0
plone-scripts-3.8.1
plone-scripts-3.8.2
plone-scripts-3.9.0
plone-scripts-4.*
plone-scripts-4.0.0-alpha.2
plone-scripts-4.0.0-alpha.3
plone-slate-18.*
plone-slate-18.0.0
plone-slate-18.0.1
plone-slate-18.0.2
plone-slate-18.0.3
plone-slate-18.0.4
plone-slate-18.1.0
plone-slate-18.2.0
plone-slate-18.2.1
plone-slate-18.2.2
plone-slate-18.2.3
plone-slate-18.3.0
plone-slate-18.3.1
plone-slate-18.4.0
plone-slate-18.5.0
plone-slate-18.5.1
plone-slate-18.6.0
plone-slate-19.*
plone-slate-19.0.0-alpha.1
plone-slate-19.0.0-alpha.2
plone-slate-19.0.0-alpha.3
plone-slate-19.0.0-alpha.4
plone-slate-19.0.0-alpha.5
plone-slots-1.*
plone-slots-1.0.0-alpha.0
plone-slots-1.0.0-alpha.1
plone-theming-1.*
plone-theming-1.0.0-alpha.0
plone-types-1.*
plone-types-1.1.0
plone-types-1.2.0
plone-types-1.3.0
plone-types-1.3.1
plone-types-1.3.2
plone-types-1.3.3
plone-types-1.4.0
plone-types-1.4.1
plone-types-1.4.2
plone-types-1.4.3
plone-types-1.4.4
plone-types-1.4.5
plone-types-2.*
plone-types-2.0.0-alpha.4
plone-types-2.0.0-alpha.5
plone-types-2.0.0-alpha.6
plone-volto-testing-4.*
plone-volto-testing-4.0.0
plone-volto-testing-5.*
plone-volto-testing-5.0.0-alpha.1