CVE-2025-27913

2.1 lowEPSS 0.2%

Low (2.1) in passbolt passbolt api. EPSS 0.2% chance of exploitation in the next 30 days.

Passbolt API before 5, if the server is misconfigured (with an incorrect installation process and disregarding of Health Check results), can send email messages with a domain name taken from an attacker-controlled HTTP Host header.

Severity

CVSS 4.0

2.1 low

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 8% of CVEs (scores of 2026-10-31)
CWE: CWE-348
Published: 2025-03-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

passbolt:passbolt_api

References

https://www.passbolt.com/incidents/host-header-injection

Check your stack JSON