CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2025-58047
High (7.5). EPSS 0.7% chance of exploitation in the next 30 days. Fixed in @plone/volto 16.34.0, 17.22.1, 18.24.0.
Volto is a React based frontend for the Plone Content Management System. In versions from 19.0.0-alpha.1 to before 19.0.0-alpha.4, 18.0.0 to before 18.24.0, 17.0.0 to before 17.22.1, and prior to 16.34.0, an anonymous user could cause the NodeJS server part of Volto to quit with an error when visiting a specific URL. The problem has been patched in versions 16.34.0, 17.22.1, 18.24.0, and 19.0.0-alpha.4. To mitigate downtime, have setup automatically restart processes that quit with an error.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 51% of CVEs (scores of 2026-10-31)
- CWE
- CWE-755
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-xjhf-7833-3pm5 | npm | @plone/volto | <16.34.0 | 16.34.0 |
| GHSA-xjhf-7833-3pm5 | npm | @plone/volto | >=17.0.0 <17.22.1 | 17.22.1 |
| GHSA-xjhf-7833-3pm5 | npm | @plone/volto | >=18.0.0 <18.24.0 | 18.24.0 |
| GHSA-xjhf-7833-3pm5 | npm | @plone/volto | >=19.0.0-alpha.1 <19.0.0-alpha.4 | 19.0.0-alpha.4 |