CVE-2025-67165 Pagekit CMS has an Insecure Direct Object Reference (IDOR) in its User Role component
Attackers can escalate privileges via an Insecure Direct Object Reference vulnerability in Pagekit CMS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-67165?
CVE-2025-67165 is a critical vulnerability in n/a, published on 17 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An Insecure Direct Object Reference (IDOR) in Pagekit CMS v1.0.18 allows attackers to escalate privileges.
Weakness: CWE-639
Which versions are affected by CVE-2025-67165?
2 open source packages ship an affected version, including pagekit/pagekit. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pagekit/pagekit Packagist | All versions to 1.0.18 | None |
pagekit/pagekit Packagist | All versions to 1.0.18 | None |
Products include Pagekit Pagekit.
How do I fix CVE-2025-67165?
No fix has been published for CVE-2025-67165 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-67165 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-67165 exists.
Other vulnerabilities in n/a
- CVE-2025-67164 Pagekit CMS is vulnerable to OS Command Injection via Storage component
- CVE-2022-38916 Pagekit vulnerable to Unrestricted Upload of File with Dangerous Type
- CVE-2021-44135 SQL injection in pagekit/pagekit
- CVE-2019-19013 Pagekit File Upload vulnerability
- CVE-2023-41005 Command injection in pagekit
Sources
Also known as GHSA-w3j8-9p3j-3wjx.