PT-2025-47415 · Unknown · Open Forms

Published 2025-11-18 · Updated 2025-11-19 · CVE-2025-64515

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Open Forms versions prior to 3.2.7 Open Forms versions prior to 3.3.3

Description Open Forms enables users to create and publish smart forms. Prior to versions 3.2.7 and 3.3.3, forms with prefill data fields dynamically set to readonly or disabled could be modified by malicious users attempting to alter data they were not authorized to change. For regular users, these form fields are marked as readonly and cannot be modified through the user interface.

Recommendations Update Open Forms to version 3.2.7 or later. Update Open Forms to version 3.3.3 or later.

Exploit

Fix

LPE

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2025-64515

GHSA-CP63-63MQ-5WVF

Affected Products

Open Forms

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64515.json · Exploit
• https://github.com/open-formulieren/open-forms/security/advisories/GHSA-cp63-63mq-5wvf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64515 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64515 · Security Note
• https://github.com/open-formulieren/open-forms/blob/bcf2dc54c695fb7c8c58712627d82c4b766248b6/CHANGELOG.rst#333-2025-11-18 · Note
• https://github.com/open-formulieren/open-forms/blob/bcf2dc54c695fb7c8c58712627d82c4b766248b6/CHANGELOG.rst#327-2025-11-18 · Note
• https://twitter.com/CVEnew/status/1991042935421317138 · Twitter Post
• https://t.me/CVEtracker/37686 · Telegram Post
• https://t.me/cveNotify/143295 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1990971771856581015 · Twitter Post