PT-2025-27638 · Homebox · Homebox

Tankerkiller125 · Published 2025-07-02 · Updated 2025-07-02 · CVE-2025-53108

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: HomeBox versions prior to 0.20.1

Description: The issue is related to a missing authorization check in the API endpoints responsible for updating and deleting inventory item attachments. This flaw allows authenticated users to perform unauthorized actions on inventory item attachments that they do not own, potentially leading to unauthorized data manipulation or loss of critical inventory data.

Recommendations: For versions prior to 0.20.1, upgrade to version 0.20.1 to resolve the issue. As a temporary mitigation measure, consider restricting access to the API endpoints responsible for updating and deleting inventory item attachments until the upgrade is applied.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-53108

GHSA-M6VX-PG9Q-VQ6M

Affected Products

Homebox

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53108.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-53108 · Security Note
• https://osv.dev/vulnerability/CVE-2025-53108 · Vendor Advisory
• https://github.com/sysadminsmedia/homebox/commit/e159dd8a0b5d01d7225795bfba5634781181df20 · Note
• https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-m6vx-pg9q-vq6m · Note
• https://twitter.com/CVEnew/status/1940429571234332879 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1940478663608218061 · Twitter Post