PT-2025-42913 · Mastodon · Mastodon

Published 2025-10-21 · Updated 2025-12-12 · CVE-2025-62605

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mastodon versions prior to 4.4.8 Mastodon versions 4.4.0 through 4.4.7 Mastodon versions prior to 4.5.0-beta.2

Description Mastodon is a free, open-source social network server based on ActivityPub. A flaw exists where an attacker can bypass quote controls in certain versions. The issue stems from how Mastodon internally handles reblogs, treating them as statuses. This allows an attacker to reblog a post, then quote their reblog, effectively previewing a post they were not authorized to quote, circumventing the intended quote controls.

Recommendations Update to Mastodon version 4.4.8 or later. Update to Mastodon version 4.5.0-beta.2 or later.

Exploit

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

BIT-MASTODON-2025-62605

CVE-2025-62605

GHSA-8H43-RCQJ-WPC6

Affected Products

Mastodon

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62605.json · Exploit
• https://github.com/mastodon/mastodon/commit/2dc4552229b55e2e4adaef675e68ed7ae123d78e · Patch
• https://github.com/mastodon/mastodon/commit/405a49df44033e7d179f3d44d59fb68a67d54789 · Patch
• https://github.com/mastodon/mastodon/security/advisories/GHSA-8h43-rcqj-wpc6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62605 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62605 · Security Note
• https://osv.dev/vulnerability/BIT-mastodon-2025-62605 · Vendor Advisory
• https://github.com/mastodon/mastodon/releases/tag/v4.5.0-beta.2 · Note
• https://github.com/mastodon/mastodon/releases/tag/v4.4.8 · Note
• https://t.me/cveNotify/139676 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1980721513243316387 · Twitter Post
• https://t.me/cveNotify/145607 · Telegram Post