CVE-2025-67718

Form.io is a combined Form and API platform for Serverless applications. Versions 3.5.6 and below and 4.0.0-rc.1 through 4.4.2 contain a flaw in path handling which could allow an attacker to access protected API endpoints by sending a crafted request path. An unauthenticated or unauthorized request could retrieve data from endpoints that should be protected. This issue is fixed in versions 3.5.7 and 4.4.3.

CVSS

No CVSS.

References

Link	Resource
https://github.com/formio/formio/commit/1836bdd9f55f5888ff397c257b2108c09d3de478
https://github.com/formio/formio/security/advisories/GHSA-m654-769v-qjv7

Configurations

No configuration.

History

14 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Form.io es una plataforma combinada de formularios y API para aplicaciones sin servidor. Las versiones 3.5.6 e inferiores y 4.0.0-rc.1 hasta 4.4.2 contienen una falla en el manejo de rutas que podría permitir a un atacante acceder a puntos finales de API protegidos enviando una ruta de solicitud manipulada. Una solicitud no autenticada o no autorizada podría recuperar datos de puntos finales que deberían estar protegidos. Este problema está solucionado en las versiones 3.5.7 y 4.4.3.

Information

Published : 2025-12-11 01:16

Updated : 2026-10-14 20:10

NVD link : CVE-2025-67718

Mitre link : CVE-2025-67718

CVE.ORG link : CVE-2025-67718

JSON object : View

Products Affected

No product.

CWE

CWE-178

Improper Handling of Case Sensitivity

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2025-67718", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-67718", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-11T15:35:27.471694Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "formio", "product": "formio", "versions": [{"status": "affected", "version": "< 3.5.7"}, {"status": "affected", "version": ">= 4.0.0-rc.1, < 4.4.3"}]}]}], "published": "2025-12-11T01:16:01.157", "references": [{"url": "https://github.com/formio/formio/commit/1836bdd9f55f5888ff397c257b2108c09d3de478", "source": "security-advisories@github.com"}, {"url": "https://github.com/formio/formio/security/advisories/GHSA-m654-769v-qjv7", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-178"}, {"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Form.io is a combined Form and API platform for Serverless applications. Versions 3.5.6 and below and 4.0.0-rc.1 through 4.4.2 contain a flaw in path handling which could allow an attacker to access protected API endpoints by sending a crafted request path. An unauthenticated or unauthorized request could retrieve data from endpoints that should be protected. This issue is fixed in versions 3.5.7 and 4.4.3."}, {"lang": "es", "value": "Form.io es una plataforma combinada de formularios y API para aplicaciones sin servidor. Las versiones 3.5.6 e inferiores y 4.0.0-rc.1 hasta 4.4.2 contienen una falla en el manejo de rutas que podr\u00eda permitir a un atacante acceder a puntos finales de API protegidos enviando una ruta de solicitud manipulada. Una solicitud no autenticada o no autorizada podr\u00eda recuperar datos de puntos finales que deber\u00edan estar protegidos. Este problema est\u00e1 solucionado en las versiones 3.5.7 y 4.4.3."}], "lastModified": "2026-10-14T20:10:00.190", "sourceIdentifier": "security-advisories@github.com"}