PT-2025-50565 · Form.Io · Form.Io

Published 2025-12-11 · Updated 2025-12-11 · CVE-2025-67718

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Form.io versions 3.5.6 and below, and 4.0.0-rc.1 through 4.4.2

Description A flaw in path handling exists that could allow an attacker to access protected API endpoints by sending a crafted request path. An unauthenticated or unauthorized request could potentially retrieve data from endpoints that should be protected.

Recommendations Update to version 3.5.7 or later. Update to version 4.4.3 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

CWE-178

Related Identifiers

CVE-2025-67718

GHSA-M654-769V-QJV7

Affected Products

Form.Io

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67718.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-67718 · Security Note
• https://osv.dev/vulnerability/CVE-2025-67718 · Vendor Advisory
• https://github.com/formio/formio/commit/1836bdd9f55f5888ff397c257b2108c09d3de478 · Note
• https://github.com/formio/formio/security/advisories/GHSA-m654-769v-qjv7 · Note
• https://twitter.com/CVEnew/status/1999108888101372165 · Twitter Post
• https://t.me/CVEtracker/39434 · Telegram Post
• https://t.me/cveNotify/145399 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1999048111834960011 · Twitter Post