CVE-2025-67397 - An issue in Passy v.1.6.3 allows a remote authenticated attacker to execute arbitrary commands via a crafted HTTP request using a specific payload injection

Back Back to CVE browser

CRITICAL

An issue in Passy v.1.6.3 allows a remote authenticated attacker to execute arbitrary commands via a crafted HTTP request using a specific payload injection

Published Jan 5, 2026

9.1

CRITICAL

CVSS 3.1

EPSS 0.76%

Description

An issue in Passy v.1.6.3 allows a remote authenticated attacker to execute arbitrary commands via a crafted HTTP request using a specific payload injection.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-77

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-0804
Advisory
https://github.com/giulioschiavone/Vulnerability-Research/tree/main/CVE-2025-67397
Third Party Advisory
https://www.passy.it/
Product

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-0804		Advisory
https://github.com/giulioschiavone/Vulnerability-Research/tree/main/CVE-2025-67397		Third Party Advisory
https://www.passy.it/		Product