Vulnerability · Published Nov 4, 2025 · Assigned by GitHub_M

CVE-2025-62369Xibo CMS: Remote Code Execution through module templates

High 7.2

In plain English

A high-severity code injection in xibo-cms from xibosignage. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)1.0%top 38.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Xibo is an open source digital signage platform with a web content management system (CMS). Versions 4.3.0 and below contain a Remote Code Execution vulnerability in the CMS Developer menu's Module Templating functionality, allowing authenticated users with "System -> Add/Edit custom modules and templates" permissions to manipulate Twig filters and execute arbitrary server-side functions as the web server user. This issue is fixed in version 4.3.1. To workaround this issue, use the 4.1 and 4.2 patch commits.

Affected products (as reported)

Vendor	Product	Versions
xibosignage	xibo-cms	< 4.3.1

Weakness: CWE-94, CWE-1336 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-7rmm-689c-gjgv x_refsource_CONFIRM
https://github.com/xibosignage/xibo-cms/commit/0f4e88396111ea027785a48dd8f5eeb14536bd71 x_refsource_MISC
https://github.com/xibosignage/xibo-cms/commit/ecd4f9d2cea739a46756a108a839cac80f65cf10 x_refsource_MISC
https://github.com/xibosignage/xibo-cms/releases/tag/4.3.1 x_refsource_MISC
https://patch-diff.githubusercontent.com/raw/xibosignage/xibo-cms/pull/3128.patch x_refsource_MISC