A Single URL Can Crash Your Website: Critical DoS Flaw (CVE-2025-58047) Found in Volto CMS

The Plone Zope Security Team has released an advisory addressing a denial-of-service vulnerability in Volto, the ReactJS-based frontend of the Plone CMS, tracked as CVE-2025-58047 with a CVSS score of 7.5. The advisory describes a DoS possible by invoking a specific URL by an anonymous user, and states that a maliciously crafted request could cause the NodeJS server part of Volto to quit with an error, allowing unauthenticated users to crash the Volto frontend.

The vulnerability has been patched, with backported fixes across all supported Volto major versions, and administrators are urged to upgrade to the latest patch releases: Volto 16 → 16.34.0, Volto 17 → 17.22.1, Volto 18 → 18.24.0, and Volto 19 → 19.0.0-alpha4. For those unable to patch immediately, the advisory offers partial mitigation: ensure setups automatically restart processes that quit with an error to minimise downtime.

The article notes that while this does not stop exploitation attempts, it helps reduce service disruption from repeated crashes, and the advisory links to the Volto GitHub releases page.