cve.bz

CVE-2025-62713

7.2 highEPSS 0.6%

Kottster is a self hosted Node.js admin panel. From versions 3.2.0 to before 3.3.2, Kottster contains a pre-authentication remote code execution (RCE) vulnerability when running in development mode. This affects development mode only, production deployments were never affected. This issue has been fixed in version 3.3.2.

CVSS 4.0
7.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
EPSS
0.6% chance of exploitation in the next 30 days; higher than 48% of CVEs (scores of 2026-10-25)
CWEs
CWE-78, CWE-284
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-j3w7-9qc3-g96pnpm@kottster/server>=3.2.0 <3.3.23.3.2

References

Check your stackJSON