PT-2025-40309 · Volto · Volto

Published 2025-10-01 · Updated 2025-10-03 · CVE-2025-61668

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Volto versions 16.34.0 through 16.34.1 Volto versions 17.0.0 through 17.22.1 Volto versions 18.0.0 through 18.27.1 Volto versions 19.0.0-alpha.1 through 19.0.0-alpha.5

Description An anonymous user can cause the NodeJS server part of Volto to terminate unexpectedly by visiting a specific URL. This issue does not involve any known real-world attacks or a specific number of affected devices.

Recommendations Upgrade to Volto version 16.34.1. Upgrade to Volto version 17.22.2. Upgrade to Volto version 18.27.2. Upgrade to Volto version 19.0.0-alpha.6. Ensure your setup automatically restarts processes that quit with an error to minimize downtime.

Exploit

Fix

DoS

Improper Check for Exceptional Conditions

NULL Pointer Dereference

Weakness Enumeration

CWE-754

CWE-476

Related Identifiers

CVE-2025-61668

GHSA-M8RJ-PPPH-MJ33

Affected Products

Volto

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61668.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-61668 · Security Note
• https://osv.dev/vulnerability/CVE-2025-61668 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m8rj-ppph-mj33 · Vendor Advisory
• https://github.com/plone/volto · Note
• https://github.com/plone/volto/pull/7412 · Note
• https://github.com/plone/volto/releases/tag/17.22.2 · Note
• https://github.com/plone/volto/commit/58d9f82d2d50ca9a87edbe16fed91762e57c109c · Note
• https://github.com/plone/volto/pull/7413 · Note
• https://github.com/plone/volto/security/advisories/GHSA-m8rj-ppph-mj33 · Note
• https://github.com/plone/volto/releases/tag/16.34.1 · Note
• https://github.com/plone/volto/releases/tag/19.0.0-alpha.6 · Note
• http://github.com/plone/volto/releases/tag/18.27.2 · Note
• https://t.me/CVEtracker/33986 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1973901121354699249 · Twitter Post