Login Request a demo
High severity · published Nov 4, 2025
CVE-2025-62369
Xibo CMS: Remote Code Execution through module templates
7.2
CVSS
1%
EPSS
No
On KEV
Description
Xibo is an open source digital signage platform with a web content management system (CMS). Versions 4.3.0 and below contain a Remote Code Execution vulnerability in the CMS Developer menu's Module Templating functionality, allowing authenticated users with "System -> Add/Edit custom modules and templates" permissions to manipulate Twig filters and execute arbitrary server-side functions as the web server user. This issue is fixed in version 4.3.1. To workaround this issue, use the 4.1 and 4.2 patch commits.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XI
xibo-cms · xibosignage
< 4.3.1 · source: vendor
XI
Xibo · Xibosignage
4.1.0 before 4.3.1 · source: NVD
Affected product
XI
xibo-cms
xibosignage
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-62369
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-62369
Patch
https://github.com/xibosignage/xibo-cms/commit/0f4e88396111ea027785a48dd8f5eeb14536bd71
Patch
https://github.com/xibosignage/xibo-cms/commit/ecd4f9d2cea739a46756a108a839cac80f65cf10
Release Notes
https://github.com/xibosignage/xibo-cms/releases/tag/4.3.1
Third Party Advisory
https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-7rmm-689c-gjgv
Product
https://patch-diff.githubusercontent.com/raw/xibosignage/xibo-cms/pull/3128.patch
More from xibo-cms
8.1
CVE-2026-31952
Xibo CMS API has SQL Injection via DataSet Filter Parameter
8.1
CVE-2024-41802
Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Data Import
7.7
CVE-2026-42141
Xibo: Authenticated Server-Side Request Forgery (SSRF) in Library Upload via URL functionality
7.6
CVE-2026-42558
Xibo Vulnerable to Stored XSS and Iframe Sandbox Escape via Data Connector Script in DataSet
7.1
CVE-2026-52729
Xibo: IDOR (Broken Object-Level Authorization) on PUT/DELETE /action/{id} Allows Arbitrary Layout Action Modification and Deletion