CVE-2025-62713

Kottster is a self hosted Node.js admin panel. From versions 3.2.0 to before 3.3.2, Kottster contains a pre-authentication remote code execution (RCE) vulnerability when running in development mode. This affects development mode only, production deployments were never affected. This issue has been fixed in version 3.3.2.

CVSS

No CVSS.

References

Link	Resource
https://github.com/kottster/kottster/commit/0a7d24922a23aac98372155348787670937eef89
https://github.com/kottster/kottster/security/advisories/GHSA-j3w7-9qc3-g96p

Configurations

No configuration.

History

19 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) Kottster es un panel de administración Node.js autoalojado. Desde las versiones 3.2.0 hasta antes de la 3.3.2, Kottster contiene una vulnerabilidad de ejecución remota de código (RCE) de pre-autenticación cuando se ejecuta en modo de desarrollo. Esto afecta solo al modo de desarrollo; las implementaciones de producción nunca se vieron afectadas. Este problema ha sido solucionado en la versión 3.3.2.

Information

Published : 2025-10-23 17:15

Updated : 2026-10-19 16:10

NVD link : CVE-2025-62713

Mitre link : CVE-2025-62713

CVE.ORG link : CVE-2025-62713

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-284

Improper Access Control

{"id": "CVE-2025-62713", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62713", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-10-23T16:40:41.498146Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "kottster", "product": "kottster", "versions": [{"status": "affected", "version": ">= 3.2.0, < 3.3.2"}]}]}], "published": "2025-10-23T17:15:40.290", "references": [{"url": "https://github.com/kottster/kottster/commit/0a7d24922a23aac98372155348787670937eef89", "source": "security-advisories@github.com"}, {"url": "https://github.com/kottster/kottster/security/advisories/GHSA-j3w7-9qc3-g96p", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-78"}, {"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "Kottster is a self hosted Node.js admin panel. From versions 3.2.0 to before 3.3.2, Kottster contains a pre-authentication remote code execution (RCE) vulnerability when running in development mode. This affects development mode only, production deployments were never affected. This issue has been fixed in version 3.3.2."}, {"lang": "es", "value": "Kottster es un panel de administraci\u00f3n Node.js autoalojado. Desde las versiones 3.2.0 hasta antes de la 3.3.2, Kottster contiene una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo (RCE) de pre-autenticaci\u00f3n cuando se ejecuta en modo de desarrollo. Esto afecta solo al modo de desarrollo; las implementaciones de producci\u00f3n nunca se vieron afectadas. Este problema ha sido solucionado en la versi\u00f3n 3.3.2."}], "lastModified": "2026-10-19T16:10:00.260", "sourceIdentifier": "security-advisories@github.com"}