CVE-2025-25286: Crayfish allows Remote Code Execution via Homarus Authorization header

January 15, 2025 (updated February 13, 2025)

Remote code execution may be possible in web-accessible installations of Homarus in certain configurations.

References

github.com/Islandora/Crayfish
github.com/Islandora/Crayfish/commit/64cb4cec688928798cc40e6f0a0e863d7f69fd89
github.com/Islandora/Crayfish/security/advisories/GHSA-mm6v-68qp-f9fw
github.com/advisories/GHSA-mm6v-68qp-f9fw
nvd.nist.gov/vuln/detail/CVE-2025-25286

Code Behaviors & Features

Detect and mitigate CVE-2025-25286 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →