High severityOSV Advisory· Published Oct 23, 2025· Updated Apr 15, 2026

CVE-2025-62713

Description

Kottster is a self hosted Node.js admin panel. From versions 3.2.0 to before 3.3.2, Kottster contains a pre-authentication remote code execution (RCE) vulnerability when running in development mode. This affects development mode only, production deployments were never affected. This issue has been fixed in version 3.3.2.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
@kottster/servernpm	>= 3.2.0, < 3.3.2	3.3.2

Affected products

Kottster/KottsterOSV
Range: v3.3.0, v3.3.1
ghsa-coords
pkg:npm/%40kottster/server
Range: >= 3.2.0, < 3.3.2

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-j3w7-9qc3-g96pghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-62713ghsaADVISORY
github.com/kottster/kottster/commit/0a7d24922a23aac98372155348787670937eef89nvdWEB
github.com/kottster/kottster/security/advisories/GHSA-j3w7-9qc3-g96pnvdWEB

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000