{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.0.18"}],"component":"pagekit/pagekit","cve_ids":["CVE-2025-67164"],"ecosystem":"Packagist","epss":0.00535,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-m4f2-xpfq-h97v","id":"tcs_01M5KF54BGGNM61KK1QYVX0VHP","modified_at":"2025-12-18T15:56:17.335521Z","published_at":"2025-12-17T18:31:33Z","references":["https://osv.dev/vulnerability/GHSA-m4f2-xpfq-h97v","https://nvd.nist.gov/vuln/detail/CVE-2025-67164","https://github.com/mbiesiad/vulnerability-research/tree/main/CVE-2025-67164","https://github.com/pagekit/pagekit"],"severity":{"label":"critical","score":9.9},"sources":[{"source":"osv","source_id":"GHSA-m4f2-xpfq-h97v","url":"https://osv.dev/vulnerability/GHSA-m4f2-xpfq-h97v"}],"summary":"Pagekit CMS is vulnerable to OS Command Injection via Storage component"}