# CVE-2025-58047: Plone Volto denial-of-service by specific URL

Source: https://junglewise.ai/threats/cve-2025-58047-plone-volto-denial-of-service-by-specific-url  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-58047 · Severity: low · CVSS 3.1 · Published 2025-08-28

Plone Volto is a headless CMS and content management platform built on Node.js. An unauthenticated attacker can crash the Node.js server by accessing a specific URL, causing service disruption. Automatic process restart capabilities mitigate downtime but do not prevent the crash itself.

Technologies: [Plone Volto](https://junglewise.ai/threats/technologies/volto). Vendors: [Plone](https://junglewise.ai/threats/vendors/plone).

## Quick answers

**Is CVE-2025-58047 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-58047 being exploited in the wild.

**How severe is CVE-2025-58047?** Low severity, with a CVSS score of 3.1, published 28 August 2025.

**Which products and versions are affected?** Plone Volto before 16.34.0; 17.0.0 before 17.22.1; 18.0.0 before 18.24.0; 19.0.0-alpha.1 before 19.0.0-alpha.4.

**Is there a fix for CVE-2025-58047?** A patch was published on 2025-08-28: Patches released for versions 16.34.0, 17.22.1, 18.24.0, and 19.0.0-alpha4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-58047 attacked?** It is attacked over the network.

**Am I affected by CVE-2025-58047?** Check whether you run Plone Volto at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Volto is vulnerable to a denial-of-service condition in its Node.js server component triggered by accessing a specific URL without authentication. The root cause involves improper error handling (CWE-755) that allows an anonymous user to cause the server process to exit with an unhandled error. The attack requires only network access and no user interaction; no privileges are required. An attacker can repeatedly invoke the vulnerable URL to cause repetitive server crashes and service unavailability. Patches are available for Volto 16.34.0, 17.22.1, 18.24.0, and 19.0.0-alpha4 and later; users should upgrade to the latest patch release of their respective major version.

## Affected products

- Plone Volto before 16.34.0; 17.0.0 before 17.22.1; 18.0.0 before 18.24.0; 19.0.0-alpha.1 before 19.0.0-alpha.4

## Identifiers

- CVE-2025-58047
- GHSA-xjhf-7833-3pm5

## Timeline

- 2025-08-28: disclosed: Advisory published
- 2025-08-28: patched: Patches released for versions 16.34.0, 17.22.1, 18.24.0, and 19.0.0-alpha4

## References

- [https://github.com/plone/volto/security/advisories/GHSA-xjhf-7833-3pm5](https://github.com/plone/volto/security/advisories/GHSA-xjhf-7833-3pm5)

## Related threats

- [Plone Volto denial of service via specific URL](https://junglewise.ai/threats/cve-2025-61668-plone-volto-denial-of-service-via-specific-url)
- [Plone Volto auth token swap due to outdated react-cookie](https://junglewise.ai/threats/cve-2022-24740-plone-volto-auth-token-swap-due-to-outdated-react-cookie)