CVE-2025-34060 Monero Forum Remote Code Execution via Arbitrary File Read and Cookie Forgery
Attackers can achieve remote code execution on the Monero Project forum by exploiting unsafe file handling and deserialization flaws to forge cookies.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-34060?
CVE-2025-34060 is a critical code injection vulnerability in Monero Project Forum, published on 1 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A PHP objection injection vulnerability exists in the Monero Project’s Laravel-based forum software due to unsafe handling of untrusted input in the /get/image/ endpoint. The application passes a user-supplied link parameter directly to file_get_contents() without validation. MIME type checks using PHP’s finfo can be bypassed via crafted stream filter chains that prepend spoofed headers, allowing access to internal Laravel configuration files. An attacker can extract the APP_KEY from config/app.php, forge encrypted cookies, and trigger unsafe unserialize() calls, leading to reliable remote code execution.
Which versions are affected by CVE-2025-34060?
How do I fix CVE-2025-34060?
No fix has been published for CVE-2025-34060 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-34060 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-34060 exists.
Sources
Also known as GHSA-w4vr-ppq6-f2xg.