PT-2025-10631 · Passbolt · Passbolt Api

David Silva · Published 2025-03-10 · Updated 2025-03-11 · CVE-2025-27913

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Passbolt API versions prior to 5

Description The issue arises when the server is misconfigured, specifically with an incorrect installation process and disregard of Health Check results. In such cases, the Passbolt API can send email messages with a domain name taken from an attacker-controlled HTTP Host header.

Recommendations For versions prior to 5, ensure proper server configuration, following the correct installation process and adhering to Health Check results to prevent exploitation. As a temporary workaround, consider restricting access to the email functionality until the issue is resolved.

Fix

Weakness Enumeration

CWE-348

Related Identifiers

CVE-2025-27913

Affected Products

Passbolt Api

References · 8

• https://osv.dev/vulnerability/CVE-2025-27913 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27913 · Security Note
• https://passbolt.com/incidents/host-header-injection · Vendor Advisory
• https://twitter.com/CVETracker/status/1899551082738569496 · Twitter Post
• https://t.me/cvedetector/19987 · Telegram Post
• https://twitter.com/CVEnew/status/1899197300129644892 · Twitter Post
• https://t.me/cvenotify/114157 · Telegram Post
• https://t.me/cvetracker/18846 · Telegram Post