PT-2025-43531 · Kottster · Kottster

Published 2025-10-23 · Updated 2025-10-28 · CVE-2025-62713

Positive Technologies (AI Summary)

CVSS v4.0

7.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions Kottster versions 3.2.0 through 3.3.1

Description Kottster is a self-hosted Node.js admin panel. Versions 3.2.0 through 3.3.1 contain a pre-authentication remote code execution (RCE) vulnerability when running in development mode. Production deployments are not affected.

Recommendations Update to version 3.3.2 or later.

Exploit

Fix

RCE

Improper Access Control

OS Command Injection

Weakness Enumeration

CWE-284

CWE-78

Related Identifiers

CVE-2025-62713

GHSA-J3W7-9QC3-G96P

Affected Products

Kottster

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62713.json · Exploit
• https://osv.dev/vulnerability/GHSA-j3w7-9qc3-g96p · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62713 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62713 · Security Note
• https://github.com/kottster/kottster · Note
• https://github.com/kottster/kottster/security/advisories/GHSA-j3w7-9qc3-g96p · Note
• https://github.com/kottster/kottster/commit/0a7d24922a23aac98372155348787670937eef89 · Note
• https://reddit.com/r/VulnMatter/comments/1oibp2u/resumen_diario_de_vulnerabilidades_28102025 · Reddit Post
• https://t.me/CVEtracker/35587 · Telegram Post
• https://twitter.com/SecAideInfo/status/1982390104065712322 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1ofsmpa/resumen_diario_de_vulnerabilidades_25102025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1ogn557/resumen_diario_de_vulnerabilidades_26102025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1oezejc/resumen_diario_de_vulnerabilidades_24102025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1ogywhf/resumen_diario_de_vulnerabilidades_26102025 · Reddit Post
• https://twitter.com/CVEnew/status/1981401991289954474 · Twitter Post