CVE-2025-8814 atjiu pybbs CookieUtil.java setCookie cross-site request forgery
Attackers can perform cross-site request forgery attacks against pybbs users, potentially bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-8814?
CVE-2025-8814 is a medium-severity vulnerability in atjiu pybbs, published on 10 Aug 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability was found in atjiu pybbs up to 6.0.0 and classified as problematic. This issue affects the function setCookie of the file src/main/java/co/yiiu/pybbs/util/CookieUtil.java. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named 8aa2bb1aef3346e49aec6358edf5e47ce905ae7b. It is recommended to apply a patch to fix this issue.
Which versions are affected by CVE-2025-8814?
It affects 1 product.
Products include Pybbs Project Pybbs.
How do I fix CVE-2025-8814?
No fix has been published for CVE-2025-8814 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-8814 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-8814 exists.
Other vulnerabilities in atjiu pybbs
- CVE-2020-28702 SQL injection in n/a
- CVE-2025-8546 atjiu pybbs Verification Code login Captcha
- CVE-2025-8547 atjiu pybbs Email Verification improper authorization
- CVE-2025-8548 atjiu pybbs Registered Email SettingsApiController.java sendEmailCode information exposure
- CVE-2025-8549 atjiu pybbs UserAdminController.java update weak password
Sources
Also known as GHSA-c2f9-wj95-7cj4.