PT-2026-25691 · Raytha · Raytha

Daniel Basta · Published 2026-03-16 · Updated 2026-03-16 · CVE-2025-69238

Telegram · Cvenotify

CVSS v4.0

6.9

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

🚨 CVE-2025-69238 Raytha CMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. Attacker can craft special website, which when visited by the authenticated victim, will automatically send POST request to the endpoint (e. x. deletion of the data) without enforcing token verification. 

This issue was fixed in version 1.4.6.

🎖@cveNotify

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-69238

Affected Products

Raytha

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-69238 · Security Note
• https://raytha.com · Note
• https://t.me/cveNotify/155554 · Telegram Post
• https://twitter.com/CVEnew/status/2033583657324331334 · Twitter Post
• https://cert.pl/en/posts/2026/03/CVE-2025-69236 · Note