CVE-2025-9747

MEDIUM

Koillection < 1.7.0 - Cross-Site Request Forgery in CSRF Protection Controller

Title source: llm
STIX 2.1

Description

A vulnerability has been found in Koillection up to 1.6.18. Affected is an unknown function of the file assets/controllers/csrf_protection_controller.js. Such manipulation leads to cross-site request forgery. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.7.0 is able to address this issue. The name of the patch is 9ab8562d3f1e953da93fed63f9ee802c7ea26a9a. It is suggested to upgrade the affected component. The vendor explains: "I ended up switching to a newer CSRF handling using stateless token."

References (8)

Core 8
Core References
Third Party Advisory, VDB Entry vdb-entry
https://vuldb.com/?id.322047
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.322047
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.640421
Exploit, Issue Tracking, Third Party Advisory issue-tracking
https://github.com/benjaminjonard/koillection/issues/1393
Exploit, Issue Tracking, Third Party Advisory issue-tracking
https://github.com/benjaminjonard/koillection/issues/1393#issuecomment-3217310072
Exploit, Issue Tracking, Third Party Advisory exploit issue-tracking
https://github.com/benjaminjonard/koillection/issues/1393#issue-3347724086

Scores

CVSS v3 4.3
EPSS 0.0037
EPSS Percentile 29.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-352 CWE-862
Status published
Products (1)
benjaminjonard/koillection < 1.7.0
Published Aug 31, 2025
Tracked Since Feb 18, 2026