CVE-2025-65656
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
dcat-admin v2.2.3-beta and earlier is vulnerable to file inclusion in admin/src/Extend/VersionManager.php.
Risk Assessment
The vulnerability may allow an attacker to include unauthorized files, potentially leading to code execution or data disclosure depending on configuration.
Recommendation
Upgrade dcat-admin to a version later than v2.2.3-beta if available, or apply mitigations. Review and restrict access to the VersionManager functionality.
Other vulnerabilities in dcat-admin
See all- CVE-2026-11621Medium
Dcat-Admin up to version 2.2.3-beta has a vulnerability in the editorMDUpload function on the user settings page. Manipulation of the editormd-image-file argument leads to unrestricted file upload. The attack can be remote.
- CVE-2024-29644Medium
A Cross-Site Scripting (XSS) vulnerability exists in dcat-admin version 2.1.3 and earlier. A remote attacker can inject a malicious script via the user login box to execute arbitrary code.
- CVE-2023-33736Medium
Dcat-Admin v2.1.3-beta has a stored cross-site scripting (XSS) vulnerability that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL parameter.
Original NVD description (English source)
dcat-admin v2.2.3-beta and before is vulnerable to file inclusion in admin/src/Extend/VersionManager.php.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS