Vulnerability · Published Oct 2, 2025 · Assigned by GitHub_M
CVE-2025-61668@plone/volto vulnerable to potential DoS by invoking specific URL by anonymous user
High 8.7
In plain English
A high-severity null pointer dereference in volto from plone. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Volto is a ReactJS-based frontend for the Plone Content Management System. Versions 16.34.0 and below, 17.0.0 through 17.22.1, 18.0.0 through 18.27.1, and 19.0.0-alpha.1 through 19.0.0-alpha.5, an anonymous user could cause the NodeJS server part of Volto to quit with an error when visiting a specific URL. This issue is fixed in versions 16.34.1, 17.22.2, 18.27.2 and 19.0.0-alpha.6.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @plone/volto | 16.34.1 | GHSA-m8rj-ppph-mj33 |
| npm | @plone/volto | 17.22.2 | GHSA-m8rj-ppph-mj33 |
| npm | @plone/volto | 18.27.2 | GHSA-m8rj-ppph-mj33 |
| npm | @plone/volto | 19.0.0-alpha.6 | GHSA-m8rj-ppph-mj33 |
Affected products (as reported)
Weakness: CWE-476, CWE-754 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
References
- https://github.com/plone/volto/security/advisories/GHSA-m8rj-ppph-mj33 x_refsource_CONFIRM
- https://github.com/plone/volto/pull/7412 x_refsource_MISC
- https://github.com/plone/volto/pull/7413 x_refsource_MISC
- https://github.com/plone/volto/commit/58d9f82d2d50ca9a87edbe16fed91762e57c109c x_refsource_MISC
- https://github.com/plone/volto/releases/tag/16.34.1 x_refsource_MISC
- https://github.com/plone/volto/releases/tag/17.22.2 x_refsource_MISC
- https://github.com/plone/volto/releases/tag/19.0.0-alpha.6 x_refsource_MISC
- http://github.com/plone/volto/releases/tag/18.27.2 x_refsource_MISC