CVE-2025-71455 · Runtime
NO FIX YET · SEE WHAT TO DO
vtenext before 25.02.2 returns the PHPSESSID session cookie value through its Touch web service endpoint, so the HttpOnly protection does not stop it from being read. An attacker who can run script in the vtenext origin, for example through cross-site scripting, can take over logged-in sessions.
first public Nov 4, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any vtenext deployment before 25.02.2 is exposed. Exploitation requires script execution in the vtenext origin, such as through an XSS flaw, so instances without any XSS exposure carry lower practical risk. unknown for further detail on which endpoint configurations are affected.
Not affected if patched-version
Who cares php, self-hosted, vtenext
25.02.2.25.02.2 or later.vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the PHPSESSID value returned by the Touch web service endpoint. Attackers who can run script in the vtenext origin, such as through cross-site scripting, can bypass the HttpOnly flag and hijack authenticated sessions.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.