CVE-2025-62369

HIGH

Xibo < 4.3.1 - Remote Code Execution

Title source: rule

Description

Xibo is an open source digital signage platform with a web content management system (CMS). Versions 4.3.0 and below contain a Remote Code Execution vulnerability in the CMS Developer menu's Module Templating functionality, allowing authenticated users with "System -> Add/Edit custom modules and templates" permissions to manipulate Twig filters and execute arbitrary server-side functions as the web server user. This issue is fixed in version 4.3.1. To workaround this issue, use the 4.1 and 4.2 patch commits.

Exploits (2)

github WRITEUP 1 stars
by cristibtz · javapoc
https://github.com/cristibtz/Security-Research/tree/main/CVE-2025-62369
nomisec WORKING POC
by cristibtz · poc
https://github.com/cristibtz/CVE-2025-62369

References (5)

Scores

CVSS v3 7.2
EPSS 0.0055
EPSS Percentile 67.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Classification

CWE
CWE-1336 CWE-94
Status published

Affected Products (1)

xibosignage/xibo < 4.3.1

Timeline

Published Nov 04, 2025
Tracked Since Feb 18, 2026