PYSEC-2025-179

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/pycti/PYSEC-2025-179.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2025-179
Aliases
Published
2025-05-05T17:18:47.397Z
Modified
2026-05-20T09:19:14.224246Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

OpenCTI is an open cyber threat intelligence (CTI) platform. Prior to version 6.4.11 any user with the capability manage customizations can execute commands on the underlying infrastructure where OpenCTI is hosted and can access internal server side secrets by misusing the web-hooks. Since the malicious user gets a root shell inside a container this opens up the the infrastructure environment for further attacks and exposures. Version 6.4.11 fixes the issue.

References

Affected packages

PyPI / pycti

Package

Name
pycti
View open source insights on deps.dev
Purl
pkg:pypi/pycti

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.4.8
Fixed
6.4.11

Affected versions

6.*
6.4.8
6.4.9
6.4.10

Database specific

source 
"https://github.com/pypa/advisory-database/blob/main/vulns/pycti/PYSEC-2025-179.yaml"