CVE-2025-71454 · Package
NO FIX YET · SEE WHAT TO DO
VTENext before 25.02.2 skips its CSRF token check for non-POST requests, so state-changing GET requests are not validated. An attacker who tricks a logged-in user into opening a crafted link can make actions run under that user's account.
first public Nov 4, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
VTENext installations before 25.02.2 are exposed, because csrf_check() does not validate the CSRF token on GET requests and handlers read from $_REQUEST. Teams running a self-hosted VTENext CRM where logged-in staff browse other sites are most at risk. Installations already on 25.02.2 or later are not affected by this flaw.
Not affected if version-25.02.2-or-later
Who cares php, self-hosted, vtenext
25.02.2.include/utils/VteCsrf.php for the csrf_check() function and whether it skips __csrf_token validation for non-POST requests.25.02.2 or later.vtenext before 25.02.2 contains a cross-site request forgery protection bypass because csrf_check() in include/utils/VteCsrf.php skips __csrf_token validation for non-POST requests. Attackers can induce a logged-in user to open a crafted link sending state-changing GET requests, which handlers read from $_REQUEST, performing actions as that user.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.