Path Handling Vulnerability in Form.io API Platform
CVE-2025-67718

8.7HIGH

Key Information:

Vendor

Formio

Status
Formio
Vendor
CVE Published:
11 December 2025

What is CVE-2025-67718?

Form.io, a comprehensive Form and API platform tailored for Serverless applications, contains a critical flaw in its path handling mechanism. This issue affects versions 3.5.6 and earlier, as well as 4.0.0-rc.1 through 4.4.2. By sending specially crafted request paths, an attacker could exploit this vulnerability to access protected API endpoints. This could result in unauthorized retrieval of sensitive information from endpoints that are otherwise secured. The vulnerability has been addressed in subsequent releases (3.5.7 and 4.4.3), underscoring the importance of updating to these versions to mitigate potential security risks.

Affected Version(s)

formio < 3.5.7 < 3.5.7

formio >= 4.0.0-rc.1, < 4.4.3 < 4.0.0-rc.1, 4.4.3

References

https://github.com/formio/formio/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/formio/formio/commit/1836bdd9f55f5888f...
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-67718 : Path Handling Vulnerability in Form.io API Platform