Description
Volto is a React based frontend for the Plone Content Management System. In versions from 19.0.0-alpha.1 to before 19.0.0-alpha.4, 18.0.0 to before 18.24.0, 17.0.0 to before 17.22.1, and prior to 16.34.0, an anonymous user could cause the NodeJS server part of Volto to quit with an error when visiting a specific URL. The problem has been patched in versions 16.34.0, 17.22.1, 18.24.0, and 19.0.0-alpha.4. To mitigate downtime, have setup automatically restart processes that quit with an error.
Scores
CVSS v3
7.5
EPSS
0.0011
EPSS Percentile
28.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-755
Status
published
Products (5)
plone/volto
0 - 16.34.0npm
plone/volto
< 16.34.0
plone/volto
>= 17.0.0, < 17.22.1
plone/volto
>= 18.0.0, < 18.24.0
plone/volto
>= 19.0.0-alpha.1, < 19.0.0-alpha.4
Published
Aug 28, 2025
Tracked Since
Feb 18, 2026