CVE-2021-25976 Piranha CMS - Site-wide Cross-Site Request Forgery (CSRF)
Attackers can force authenticated users to perform unauthorized actions like deleting users or editing posts in Piranha CMS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-25976?
CVE-2021-25976 is a high-severity vulnerability in PiranhaCMS Piranha, published on 16 Nov 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In PiranhaCMS, versions 4.0.0-alpha1 to 9.2.0 are vulnerable to cross-site request forgery (CSRF) when performing various actions supported by the management system, such as deleting a user, deleting a role, editing a post, deleting a media folder etc., when an ID is known.
Weakness: CWE-352
Which versions are affected by CVE-2021-25976?
2 open source packages ship an affected version, including Piranha. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
Piranha NuGet | From 4.0.0-alpha1 | 10.0-alpha1 |
Piranha NuGet | From 4.0.0-alpha1 | 10.0-alpha1 |
Products include Dotnetfoundation Piranha Cms.
How do I fix CVE-2021-25976?
Upgrade Piranha to 10.0-alpha1 or later.
Is CVE-2021-25976 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-25976 exists.
Other vulnerabilities in PiranhaCMS Piranha
- CVE-2025-57692 PiranhaCMS stored XSS
- CVE-2025-67290 Piranha has stored cross-site scripting (XSS) vulnerability
- CVE-2025-67291 Piranha has stored cross-site scripting (XSS) vulnerability
- CVE-2025-61413 Piranha CMS vulnerable to stored cross-site scripting (XSS)
- CVE-2021-25977 Piranha CMS - Stored XSS in Page Title
Sources
Also known as GHSA-ppq7-88c7-q879.