PT-2025-32004 · Unknown · Onion-Site-Template

Vessel9817 · Published 2025-08-05 · Updated 2025-08-06 · CVE-2025-54872

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions onion-site-template versions including commit 3196bd89

Description onion-site-template, a complete and scalable Tor hidden service self-hosting sample, contains a baked-in Tor image when secrets are copied from an existing onion domain. A website could be compromised if a user shares the baked-in image or if an attacker gains access to the user's device outside of a containerized environment.

Recommendations Update to a version that includes commit bc9ba0fd.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2025-54872

GHSA-MJ8M-C8W9-RW55

Affected Products

Onion-Site-Template

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54872.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-54872 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54872 · Security Note
• https://twitter.com/CVEnew/status/1952880926096228653 · Twitter Post
• https://github.com/Vessel9817/onion-site-template/commit/bc9ba0fd8cc7fbb3abc6759b351885a4501bce84 · Note
• https://github.com/Vessel9817/onion-site-template/security/advisories/GHSA-mj8m-c8w9-rw55 · Note
• https://twitter.com/VulmonFeeds/status/1952904445764739093 · Twitter Post