CVE-2025-27913
CVE-2025-27913 is a high-severity vulnerability in Passbolt Passbolt Api with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-348.
Key facts
- Severity: High (CVSS 3.x base score 7.5)
- CVSS v4: 2.1
- EPSS exploit prediction: 0% (7th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2025-7821
- Weakness: CWE-348
- Affected product: Passbolt Passbolt Api
- Published:
- Last modified:
Description
Passbolt API before 5, if the server is misconfigured (with an incorrect installation process and disregarding of Health Check results), can send email messages with a domain name taken from an attacker-controlled HTTP Host header.
Frequently asked questions
- What is CVE-2025-27913?
- Passbolt API before 5, if the server is misconfigured (with an incorrect installation process and disregarding of Health Check results), can send email messages with a domain name taken from an attacker-controlled HTTP Host header.
- How severe is CVE-2025-27913?
- CVE-2025-27913 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.
- Is CVE-2025-27913 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (7th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2025-27913?
- CVE-2025-27913 affects Passbolt Passbolt Api. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2025-27913?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- Does CVE-2025-27913 have an EU (EUVD) identifier?
- Yes. CVE-2025-27913 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-7821.
- When was CVE-2025-27913 published?
- CVE-2025-27913 was published on 2025-03-10 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:passbolt:passbolt_api:*:*:*:*:*:*:*:*
More vulnerabilities in Passbolt Passbolt Api
- CVE-2017-1000442 — Medium (CVSS 5.4): Passbolt API version 1.6.4 and older are vulnerable to a XSS in the url field on the password workspace
- CVE-2024-33670 — Medium (CVSS 4.3): Passbolt API before 4.6.2 allows HTML injection in a URL parameter, resulting in custom content being displayed when a…
All CVEs affecting Passbolt Passbolt Api →
Other CWE-348 vulnerabilities
- CVE-2026-48772 — Critical (CVSS 10.0): ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. In versions 2.0.0 through 3.0.8, the ProxySQL MySQL…
- CVE-2026-12249 — Critical (CVSS 9.0): An issue was discovered in Canonical ADSys upstream versions through v0.16.2. During Active Directory Certificate…
- CVE-2025-69240 — High (CVSS 8.8): Raytha CMS allows an attacker to spoof `X-Forwarded-Host` or `Host` headers to attacker controlled domain. The attacker…
- CVE-2025-55292 — High (CVSS 8.2): Meshtastic is an open source mesh networking solution. In the current Meshtastic architecture, a Node is identified by…
- CVE-2026-43634 — High (CVSS 7.5): HestiaCP versions 1.2.0 through 1.9.4 contain an IP spoofing vulnerability that allows unauthenticated remote attackers…
- CVE-2026-35391 — High (CVSS 7.5): Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.4.11, the getClientIP() function…