CVE-2025-58047

npm/@plone/volto CVE-2025-58047: high 7.5, EPSS 0.64%

Volto affected by possible DoS by invoking specific URL by anonymous user

Action: Upgrade @plone/volto to 16.34.0 or later.

npm i @plone/volto@16.34.0

npm i @plone/volto@17.22.1

npm i @plone/volto@18.24.0

npm i @plone/volto@19.0.0-alpha.4

Affected

Fixed versions

Sources

• osv: GHSA-xjhf-7833-3pm5
• https://github.com/plone/volto/security/advisories/GHSA-xjhf-7833-3pm5
• https://nvd.nist.gov/vuln/detail/CVE-2025-58047
• https://github.com/plone/volto/commit/2789a287ac45ad9039fb9161d465ba13241fff0a
• https://github.com/plone/volto
• https://github.com/plone/volto/releases/tag/16.34.0
• https://github.com/plone/volto/releases/tag/17.22.1
• https://github.com/plone/volto/releases/tag/18.24.0
• https://github.com/plone/volto/releases/tag/19.0.0-alpha.4
• http://www.openwall.com/lists/oss-security/2025/08/28/3

CVE-2025-58047 · published 2025-08-28T15:34:28Z · modified 2025-11-05T20:41:12Z · JSON