PT-2025-40781 · Unknown · Lachatterie Verger

Wxhwxhwxh_Mie · Published 2025-10-04 · Updated 2025-10-04 · CVE-2025-11273

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions LaChatterie Verger versions up to 1.2.10

Description A flaw exists in LaChatterie Verger that impacts the redirectToAuthorization function within the /src/main/services/mcp/oauth/provider.ts file. Manipulation of the URL argument leads to deserialization, and the attack can be carried out remotely. The exploit has been publicly released.

Recommendations Versions prior to 1.2.10 should be updated. As a temporary workaround, consider restricting access to the /src/main/services/mcp/oauth/provider.ts file.

Exploit

Fix

Deserialization of Untrusted Data

RCE

Weakness Enumeration

CWE-502

CWE-20

Related Identifiers

CVE-2025-11273

Affected Products

Lachatterie Verger

References · 8

• 🔥 https://lavender-bicycle-a5a.notion.site/Verger-RCE-26153a41781f80b694beebc22ea54579?source=copy_link · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-11273 · Security Note
• https://t.me/cveNotify/137394 · Telegram Post
• https://twitter.com/CVEnew/status/1974613989419352282 · Twitter Post
• https://vuldb.com/?id.327007 · Note
• https://vuldb.com/?ctiid.327007 · Note
• https://t.me/CVEtracker/34155 · Telegram Post
• https://vuldb.com/?submit.655871 · Note