Is CVE-2025-67290 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-67290 being exploited in the wild.

How severe is CVE-2025-67290?

Medium severity, with a CVSS score of 6.1, published 22 December 2025.

Which products and versions are affected?

Piranha (NuGet) ECOSYSTEM:introduced=0,last_affected=12.0.0.

Is there a fix for CVE-2025-67290?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-67290 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-67290?

Check whether you run Dotnetfoundation Piranha Cms or Piranha (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-67290: Piranha CMS stored XSS in Page Settings Excerpt field

CVE-2025-67290 · Severity: medium · CVSS 6.1 · Published 2025-12-22

Piranha CMS, a content management system used to build and manage websites, contains a security flaw in its page settings module. An attacker with the ability to edit pages can inject malicious scripts into the 'Excerpt' field, which will then execute in the browsers of other users or visitors who view that page. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information.

Technologies: Piranha (NuGet). Vendors: NuGet.

Quick answers

Is CVE-2025-67290 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-67290 being exploited in the wild.
How severe is CVE-2025-67290?: Medium severity, with a CVSS score of 6.1, published 22 December 2025.
Which products and versions are affected?: Piranha (NuGet) ECOSYSTEM:introduced=0,last_affected=12.0.0.
Is there a fix for CVE-2025-67290?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-67290 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-67290?: Check whether you run Dotnetfoundation Piranha Cms or Piranha (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Piranha CMS v12.1 within the Page Settings module. The vulnerability is caused by improper sanitization of user-supplied input in the 'Excerpt' field when creating or editing pages. An authenticated attacker can inject a malicious JavaScript payload into this field, which is then stored in the database. The payload executes in the context of any user's browser when the affected page is previewed in the manager interface or accessed publicly on the frontend. This allows for session hijacking, unauthorized API calls, or defacement of the site content.

Affected products

Piranha CMS Piranha CMS 12.1

Identifiers

CVE-2025-67290
GHSA-fw48-7qf9-455m

Timeline

2025-12-22: advisory: Initial disclosure and NVD publication
2025-12-22: disclosed: Public PoC released on GitHub

References

https://github.com/vuquyen03/CVE/tree/main/CVE-2025-67290

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.