CVE-2025-58047— Volto affected by possible DoS by invoking specific URL by anonymous user
Quick assessment
Affected
plone volto
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Volto是Plone Foundation开源的一个内容管理系统。 Volto 19.0.0-alpha.4和18.24.0之前版本存在安全漏洞，该漏洞源于匿名用户访问特定URL可能导致NodeJS服务器退出。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-58047
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Volto affected by possible DoS by invoking specific URL by anonymous user
Source: CVE Program / CVE List V5
Vulnerability Description
Volto is a React based frontend for the Plone Content Management System. In versions from 19.0.0-alpha.1 to before 19.0.0-alpha.4, 18.0.0 to before 18.24.0, 17.0.0 to before 17.22.1, and prior to 16.34.0, an anonymous user could cause the NodeJS server part of Volto to quit with an error when visiting a specific URL. The problem has been patched in versions 16.34.0, 17.22.1, 18.24.0, and 19.0.0-alpha.4. To mitigate downtime, have setup automatically restart processes that quit with an error.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对异常条件的处理不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Volto 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Volto是Plone Foundation开源的一个内容管理系统。 Volto 19.0.0-alpha.4和18.24.0之前版本存在安全漏洞，该漏洞源于匿名用户访问特定URL可能导致NodeJS服务器退出。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-58047
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
Qwen3.6-35B-A3B
· 16471 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2025-58047
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same vendor: plone
-
CVE-2026-57576
plone.app.dexterity and plone.app.contenttypes have a Denial -
CVE-2026-57149
plone.app.portlets Vulnerable to Remote Code Execution via T -
CVE-2026-54503
plone.app.textfield: Stored XSS by spoofing mime type -
CVE-2026-55247
plone.app.event: Denial of service via iCalendar import -
CVE-2026-55248
plone.app.portlets: Denial of service via RSS feed portlet
Same weakness: CWE-755
-
CVE-2026-112332
Motor.NET < 0.19.0 Denial of Service via JsonNet Deserializa -
CVE-2026-112331
Motor.NET < 0.19.0 Kafka Denial of Service via Structured Cl -
CVE-2026-112330
Motor.NET < 0.19.0 RabbitMQ Denial of Service via CloudEvent -
CVE-2026-85473
Out-of-Range Timestamp Claim Handling in auth0/java-jwt -
CVE-2026-105242
Apache log4net: Request validation failure drops the event i
V. Comments for CVE-2025-58047
No comments yet