HIGH🇵🇱 Wersja polska

CVE-2025-67419

CVSS 7.5v3.1pub. 2026-01-05upd. 2026-01-12

A Denial of Service (DoS) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application server's resources via the "GET /images" API. The application fails to limit the height of the use-element shadow tree or the dimensions of pattern tiles during the processing of SVG files, resulting in unbounded resource consumption and system-wide denial of service.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

  • Evershop

    APP
    Evershop
    ≤ 2.1.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Auth BypassDoS
CWE
References

Related vulnerabilities

CVE-2026-28213CRITICAL9.8PL ✓ten sam produkt

EverShop: token resetowania hasła ujawniany w odpowiedzi API

CVE-2026-25993CRITICAL9.3PL ✓ten sam produkt

Second-order SQL injection w EverShop podczas obsługi kategorii

CVE-2023-46943CRITICAL9.1PL ✓ten sam produkt

Hardkodowany sekret HMAC w @evershop/evershop umożliwia fałszowanie tokenów JWT

CVE-2023-46498CRITICAL9.8PL ✓ten sam produkt

RCE i ujawnienie danych w EverShop NPM przez plik route.json

CVE-2025-65844HIGH7.5ten sam produkt

EverShop 2.0.1 allows a remote unauthenticated attacker to upload arbitrary files and create directories via t...