CVE-2025-61668 - CVE House

Back to Database

Status published High CVE-2025-61668

@plone/volto vulnerable to potential DoS by invoking specific URL by anonymous user

8.7 CVSS

Vulnerability Description

Volto is a ReactJS-based frontend for the Plone Content Management System. Versions 16.34.0 and below, 17.0.0 through 17.22.1, 18.0.0 through 18.27.1, and 19.0.0-alpha.1 through 19.0.0-alpha.5, an anonymous user could cause the NodeJS server part of Volto to quit with an error when visiting a specific URL. This issue is fixed in versions 16.34.1, 17.22.2, 18.27.2 and 19.0.0-alpha.6.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-61668

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from plone

View All →

Volto affected by possible DoS by invoking specific URL by anonymous user

plone.rest vulnerable to Denial of Service when ++api++ is used many times

plone.namedfile vulnerable to Stored Cross Site Scripting with SVG images

Improper Authentication in Volto

Cross-site Scripting and Open Redirect in Products.ATContentTypes

Affected Vendor

plone

View all reports →

Affected Software

volto

Vulnerable Versions:

< 16.34.1, >= 17.0.0, < 17.22.2, >= 18.0.0, < 18.27.2, >= 19.0.0-alpha.1, < 19.0.0-alpha.6

Timeline

Official Publish: October 2nd, 2025

Last Modified: October 3rd, 2025

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-476 CWE-754

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service

T1499.004 Application or System Exploitation

T1489 Service Stop

T1203 Exploitation for Client Execution

T1190 Exploit Public-Facing Application

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1562 Impair Defenses

Defense Evasion

T1005 Data from Local System