CVE-2025-61668: volto < 16.34.1, >= 17.0.0, < 17.22.2, >= 18.0.0, < 18.27.2, >= 19.0.0-alpha.1, < 19.0.0-alpha.6

Affected technology

volto · < 16.34.1, >= 17.0.0, < 17.22.2, >= 18.0.0, < 18.27.2, >= 19.0.0-alpha.1, < 19.0.0-alpha.6
plone

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An anonymous user could cause the NodeJS server part of Volto to quit with an error when visiting a specific URL. Vendor/CNA’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality and integrity impact as none; availability impact as high.