What’s Vulnerable › Vulnerabilities

CVE-2025-62369: Xibo CMS: Remote Code Execution through module templates

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-11-04 · updated 2026-10-18
• Weakness: CWE-94

Description

Xibo is an open source digital signage platform with a web content management system (CMS). Versions 4.3.0 and below contain a Remote Code Execution vulnerability in the CMS Developer menu's Module Templating functionality, allowing authenticated users with "System -> Add/Edit custom modules and templates" permissions to manipulate Twig filters and execute arbitrary server-side functions as the web server user. This issue is fixed in version 4.3.1. To workaround this issue, use the 4.1 and 4.2 patch commits.

Affected products

• xibosignage xibo-cms: from 4.1.0 before 4.3.1 — fixed in 4.3.1

How to fix

Upgrade to a fixed version: xibosignage xibo-cms 4.3.1. Check the vendor advisory for mitigations.

References

• https://github.com/xibosignage/xibo-cms/commit/0f4e88396111ea027785a48dd8f5eeb14536bd71
• https://github.com/xibosignage/xibo-cms/commit/ecd4f9d2cea739a46756a108a839cac80f65cf10
• https://github.com/xibosignage/xibo-cms/releases/tag/4.3.1
• https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-7rmm-689c-gjgv
• https://patch-diff.githubusercontent.com/raw/xibosignage/xibo-cms/pull/3128.patch

Get alerted when CVE-2025-62369 or the next vulnerability affects your stack