CVE-2025-62713: Kottster app reinitialization can be re-triggered allowing command injection in development mode

Severity: high (CVSS 7.2 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-23 · updated 2026-10-19
Weakness: CWE-78

Description

Kottster is a self hosted Node.js admin panel. From versions 3.2.0 to before 3.3.2, Kottster contains a pre-authentication remote code execution (RCE) vulnerability when running in development mode. This affects development mode only, production deployments were never affected. This issue has been fixed in version 3.3.2.

Affected products

kottster: from 3.2.0, < 3.3.2

References

https://github.com/kottster/kottster/commit/0a7d24922a23aac98372155348787670937eef89
https://github.com/kottster/kottster/security/advisories/GHSA-j3w7-9qc3-g96p

Get alerted when CVE-2025-62713 or the next vulnerability affects your stack