{"id":"EUVD-2025-32508","enisaUuid":"d0fb6207-5652-377a-b26a-43ccbe2987e4","description":"Volto is a ReactJS-based frontend for the Plone Content Management System. Versions 16.34.0 and below, 17.0.0 through 17.22.1, 18.0.0 through 18.27.1, and 19.0.0-alpha.1 through 19.0.0-alpha.5, an anonymous user could cause the NodeJS server part of Volto to quit with an error when visiting a specific URL. This issue is fixed in versions 16.34.1, 17.22.2, 18.27.2 and 19.0.0-alpha.6.","datePublished":"Oct 2, 2025, 9:46:32 PM","dateUpdated":"Oct 3, 2025, 1:37:25 PM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/plone/volto/security/advisories/GHSA-m8rj-ppph-mj33\nhttps://github.com/plone/volto/pull/7412\nhttps://github.com/plone/volto/pull/7413\nhttps://github.com/plone/volto/commit/58d9f82d2d50ca9a87edbe16fed91762e57c109c\nhttps://github.com/plone/volto/releases/tag/16.34.1\nhttps://github.com/plone/volto/releases/tag/17.22.2\nhttps://github.com/plone/volto/releases/tag/19.0.0-alpha.6\nhttp://github.com/plone/volto/releases/tag/18.27.2\n","aliases":"CVE-2025-61668\nGHSA-m8rj-ppph-mj33\n","assigner":"GitHub_M","epss":0.44,"enisaIdProduct":[{"id":"35675fa5-16f1-3415-8c5f-3384165e8679","product":{"name":"volto","vendor":{"name":"plone"}},"product_version":"\u003c 16.34.1"},{"id":"ccc62abe-f5e1-33c7-b1c1-9eb34b5952f7","product":{"name":"volto","vendor":{"name":"plone"}},"product_version":"17.0.0, \u003c 17.22.2"},{"id":"ee53d70e-698b-38a1-b07e-5ca4dfa7dd61","product":{"name":"volto","vendor":{"name":"plone"}},"product_version":"18.0.0, \u003c 18.27.2"},{"id":"fe173b47-5d77-33f2-9b5b-074750a8d8ce","product":{"name":"volto","vendor":{"name":"plone"}},"product_version":"19.0.0-alpha.1, \u003c 19.0.0-alpha.6"}],"enisaIdVendor":[{"id":"20adeae5-a723-3e3b-9cd4-183592284213","vendor":{"name":"plone"}}],"enisaIdVulnerability":[{"id":"f6e2053e-ddd5-38bf-b9c9-09b4fcd833a9","vulnerability":{"id":"CVE-2025-61668","description":"Volto is a ReactJS-based frontend for the Plone Content Management System. Versions 16.34.0 and below, 17.0.0 through 17.22.1, 18.0.0 through 18.27.1, and 19.0.0-alpha.1 through 19.0.0-alpha.5, an anonymous user could cause the NodeJS server part of Volto to quit with an error when visiting a specific URL. This issue is fixed in versions 16.34.1, 17.22.2, 18.27.2 and 19.0.0-alpha.6.","datePublished":"Oct 2, 2025, 9:46:32 PM","dateUpdated":"Oct 3, 2025, 1:37:25 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/plone/volto/security/advisories/GHSA-m8rj-ppph-mj33\nhttps://github.com/plone/volto/pull/7412\nhttps://github.com/plone/volto/pull/7413\nhttps://github.com/plone/volto/commit/58d9f82d2d50ca9a87edbe16fed91762e57c109c\nhttps://github.com/plone/volto/releases/tag/16.34.1\nhttps://github.com/plone/volto/releases/tag/17.22.2\nhttps://github.com/plone/volto/releases/tag/19.0.0-alpha.6\nhttp://github.com/plone/volto/releases/tag/18.27.2\n","enisa_id":"EUVD-2025-32508\n","assigner":"GitHub_M","epss":0.44,"dataProcessed":"Nov 6, 2026, 7:20:27 AM","vulnerabilityProduct":[{"id":"4fa2774f-7f44-33e1-9d56-16a30121e9dd","product":{"name":"volto","vendor":{"name":"plone"}},"product_version":"\u003c 16.34.1"},{"id":"505cd90c-7ed6-3d10-855a-91faf89b0980","product":{"name":"volto","vendor":{"name":"plone"}},"product_version":"18.0.0, \u003c 18.27.2"},{"id":"67e896cc-f03e-312b-b8ad-bf45f778e58b","product":{"name":"volto","vendor":{"name":"plone"}},"product_version":"17.0.0, \u003c 17.22.2"},{"id":"a8b93c81-9334-377d-9c58-9a6512c7fa26","product":{"name":"volto","vendor":{"name":"plone"}},"product_version":"19.0.0-alpha.1, \u003c 19.0.0-alpha.6"}],"vulnerabilityVendor":[{"id":"6b3d0b72-f56f-3929-9662-56827d10be55","vendor":{"name":"plone"}}]}},{"id":"fa6f2697-4be6-3683-89b7-816914f67a09","vulnerability":{"id":"GHSA-m8rj-ppph-mj33","description":" @plone/volto vulnerable to potential DoS by invoking specific URL by anonymous user ","datePublished":"Oct 1, 2025, 3:53:43 PM","dateUpdated":"Oct 3, 2025, 1:22:42 PM","baseScore":0.0,"references":"https://github.com/plone/volto/security/advisories/GHSA-m8rj-ppph-mj33\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-61668\nhttps://github.com/plone/volto/pull/7412\nhttps://github.com/plone/volto/pull/7413\nhttps://github.com/plone/volto/commit/58d9f82d2d50ca9a87edbe16fed91762e57c109c\nhttps://github.com/plone/volto\nhttps://github.com/plone/volto/releases/tag/16.34.1\nhttps://github.com/plone/volto/releases/tag/17.22.2\nhttps://github.com/plone/volto/releases/tag/19.0.0-alpha.6\nhttp://github.com/plone/volto/releases/tag/18.27.2\n","enisa_id":"EUVD-2025-32508\n","aliases":"CVE-2025-61668\nGHSA-m8rj-ppph-mj33\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:55:38 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}