CVE-2025-67419

evershop allows unauthenticated attackers to exhaust application server's resources via "GET /images" API

Title source: GitHub Advisory
STIX 2.1 vulnerability

Record summary

EIP currently links 1 lab environment to CVE-2025-67419.

Description

A Denial of Service (DoS) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application server's resources via the "GET /images" API. The application fails to limit the height of the use-element shadow tree or the dimensions of pattern tiles during the processing of SVG files, resulting in unbounded resource consumption and system-wide denial of service.

Description source: CVE List

Exploitation context

Available material

Lab environments
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 5, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

@evershop/evershop

Browse npm / @evershop/evershop
GitHub AdvisoryThrough 2.1.0affected

Docker lab environments

1
GitHub

CVE-2025-67419-lab/docker-compose.yml

system-bliss/vuln-lab-dockerCreated Vuln labCVE-2025-67419Compose · mixed

1 Compose manifest · 1 Dockerfile · 3 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment for reproducing CVE-2025-67419, an SVG processing denial-of-service vulnerability in EverShop v2.1.0. It builds a custom EverShop image with crafted SVG payloads, runs a PostgreSQL database, and provides a verifier service to exercise the vulnerable GET /images endpoint.

CVE-2025-67419-lab/docker-compose.yml:1-60CVE-2025-67419-lab/Dockerfile:1-23CVE-2025-67419-lab/README.md:1-86

Lab assessment

Vulnerability lab

The environment is explicitly designed to reproduce CVE-2025-67419, an SVG DoS vulnerability in EverShop. It includes a vulnerable application version, crafted payloads, a verification script, and documentation describing the reproduction steps and expected outcomes.

CVE-2025-67419-lab/README.md:1-3CVE-2025-67419-lab/Dockerfile:5-6CVE-2025-67419-lab/lab/verify.sh:1-18
Lab shapeCompose · mixed
Services3
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

app

vulnerable EverShop application server

Builds EverShop v2.1.0 from source, copies two crafted SVG payloads into the media directory, and starts the application on port 3000. It depends on a healthy database service.

CVE-2025-67419-lab/docker-compose.yml:4-22CVE-2025-67419-lab/Dockerfile:1-23

database

PostgreSQL database for EverShop

Runs a PostgreSQL 16 instance with default credentials and a named volume for data persistence. It provides a health check to ensure readiness.

CVE-2025-67419-lab/docker-compose.yml:24-36

verifier

automated vulnerability verification

A curl-based service that executes verify.sh to send baseline and stress requests to the app's /images endpoint, capturing HTTP status codes, response times, and output images to a proof volume.

CVE-2025-67419-lab/docker-compose.yml:38-50CVE-2025-67419-lab/lab/verify.sh:1-18
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-67419

Supported by supplied evidence

The lab explicitly targets CVE-2025-67419 by building the vulnerable EverShop v2.1.0, placing crafted SVG files in the media directory, and exercising the GET /images endpoint with parameters designed to trigger resource exhaustion. The README describes the vulnerability and references the CVE record.

CVE-2025-67419-lab/README.md:1-3CVE-2025-67419-lab/Dockerfile:3-6CVE-2025-67419-lab/lab/verify.sh:7-8
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed on the host.CVE-2025-67419-lab/README.md:11-14
  • The setup script (setup.sh) must be executed to build and start the environment.CVE-2025-67419-lab/setup.sh:1-11
  • The app service must be healthy before the verifier runs, as enforced by the depends_on condition.CVE-2025-67419-lab/docker-compose.yml:42-44

Evidence-described exercise path

  1. Run setup.sh to build and start the app and database services.CVE-2025-67419-lab/setup.sh:1-11
  2. Execute the verifier service to send baseline and stress requests to the /images endpoint.CVE-2025-67419-lab/setup.sh:9-10CVE-2025-67419-lab/lab/verify.sh:7-14
  3. Observe the output for differences in response times and resource usage, indicating successful DoS reproduction.CVE-2025-67419-lab/lab/verify.sh:15-17CVE-2025-67419-lab/README.md:55-60
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is confined to the lab's own containers and intended vulnerability reproduction. The app service is exposed on a configurable host port, which is a standard lab requirement. No evidence of host escape, external connections, persistence beyond the lab, credential theft, or destructive actions is present.

CVE-2025-67419-lab/docker-compose.yml:1-60CVE-2025-67419-lab/Dockerfile:1-23CVE-2025-67419-lab/lab/verify.sh:1-18
Review boundaries

What the analysis did not establish

  • The packet does not include the actual EverShop source code or the imageProcessor.ts file, so the exact vulnerable code path cannot be confirmed from the supplied evidence alone.
  • The setup.sh script references an absolute host path (/mnt/d/HackerTools/vuln-lab-docker/CVE-2025-67419-lab) in the README, but this is only documentation and not executed by the lab itself.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

4