PT-2025-35112 · Volto+1 · Volto+1

Published 2025-08-28 · Updated 2025-10-06 · CVE-2025-58047

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Volto versions 19.0.0-alpha.1 through 19.0.0-alpha.4 Volto versions 18.0.0 through 18.24.0 Volto versions 17.0.0 through 17.22.1 Volto versions prior to 16.34.0

Description Volto, a React-based frontend for the Plone Content Management System, is susceptible to a denial-of-service (DoS) condition. An anonymous user can trigger an error that causes the NodeJS server component of Volto to terminate by visiting a specifically crafted URL. Reports indicate approximately 76.5K potentially vulnerable services are discoverable online.

Recommendations Volto versions prior to 16.34.0: Upgrade to version 16.34.0 or later. Volto versions 17.0.0 through 17.22.1: Upgrade to version 17.22.1 or later. Volto versions 18.0.0 through 18.24.0: Upgrade to version 18.24.0 or later. Volto versions 19.0.0-alpha.1 through 19.0.0-alpha.4: Upgrade to version 19.0.0-alpha.4 or later. Ensure your system is configured to automatically restart processes that terminate due to errors to minimize downtime.

Exploit

Fix

DoS

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

CVE-2025-58047

GHSA-XJHF-7833-3PM5

Affected Products

Plone

Volto

References · 25

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58047.json · Exploit
• https://osv.dev/vulnerability/GHSA-xjhf-7833-3pm5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-58047 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58047 · Security Note
• https://github.com/plone/volto · Note
• https://github.com/plone/volto/commit/2789a287ac45ad9039fb9161d465ba13241fff0a · Note
• https://github.com/plone/volto/releases/tag/16.34.0 · Note
• https://github.com/plone/volto/releases/tag/18.24.0 · Note
• https://github.com/plone/volto/security/advisories/GHSA-xjhf-7833-3pm5 · Note
• https://github.com/plone/volto/releases/tag/19.0.0-alpha.4 · Note
• https://github.com/plone/volto/releases/tag/17.22.1 · Note
• https://reddit.com/r/CVEWatch/comments/1n6fh7b/top_10_trending_cves_02092025 · Reddit Post
• https://twitter.com/zoomeye_team/status/1962460424252928078 · Twitter Post
• http://openwall.com/lists/oss-security/2025/08/28/3 · Note
• https://t.me/cveNotify/133849 · Telegram Post