CVE-2025-65681 Overhang Tutor Discloses Sensitive Information due to Improper Cache-Control
Local attackers can access sensitive information and bypass session checks due to missing cache-control headers in the tutor-open-edx deployment tool.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-65681?
CVE-2025-65681 is a low-severity vulnerability in n/a, published on 26 Nov 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to sensitive information due to the absence of proper cache-control HTTP headers and client-side session checks.
Which versions are affected by CVE-2025-65681?
3 open source packages ship an affected version, including tutor. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
tutor PyPI | All versions to 20.0.2 | None |
tutor PyPI | All versions to 20.0.2 | None |
tutor PyPI | All versions to 20.0.2 | None |
Products include Edly Tutor.
How do I fix CVE-2025-65681?
No fix has been published for CVE-2025-65681 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-65681 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-65681 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-gq25-78jf-v78c, PYSEC-2025-219.