CVE-2025-3177: A vulnerability was found in FastCMS 0.1.5

Routine

MEDIUM 5.0DOWNGRADE

CVE-2025-3177 is a medium-severity flaw (CVSS 5.0) affecting fastcms. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

A vulnerability was found in FastCMS 0.1.5. It has been declared as critical. This vulnerability affects unknown code of the component JWT Handler. The manipulation leads to use of hard-coded cryptographic key . The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.

Why this priority

Public exploit reference

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	5.0 (Medium)
Attack vector	Network (remote)
Attack complexity	High
Privileges needed	Low
User interaction	None
EPSS exploit chance	0.5% (top 58%)
CISA exploited list	No
Weakness	CWE-320, CWE-321
Published	2025-04-03
Last modified	2026-06-17

Publisher (CNA): VulDB · Vendor: fastcms project

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2025-04-03 20:15 UTCPublished CVE record published
2026-06-17 09:19 UTCUpdated Record last modified

fastcms project fastcms DOWNGRADE

Affected: 0.1.5

Fixed in: no fixed release known

Safe to downgrade to: a release before 0.1.5

1. Check installed version

apt-cache policy fastcms || rpm -q fastcms || fastcms --version

2. No fixed release: DOWNGRADE to a release before 0.1.5 (Debian / Ubuntu)

apt-cache madison fastcms sudo apt install fastcms=<VERSION_BEFORE_0.1.5> sudo apt-mark hold fastcms

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list fastcms sudo dnf downgrade fastcms-<VERSION_BEFORE_0.1.5> sudo dnf versionlock add fastcms

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2025-3177?

fastcms: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2025-3177 being exploited?

CVE-2025-3177 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2025-3177 affect?

CVE-2025-3177 affects fastcms. Severity is medium (CVSS 5.0). A vulnerability was found in FastCMS 0.1.5. It has been declared as critical. This vulnerability affects unknown code of the component JWT Handler. The manipulation leads to use of hard-coded cryptographic key . The attack can be initiated

How urgent is CVE-2025-3177?

Priority 33/100. Public exploit reference

Related CVEs

CVE-2026-26682 HIGH 7.8 UPGRADE An issue in fastCMS before v.0.1.6 allows a local attacker to execute arbitrary code via the PluginController.
CVE-2025-1332 LOW 2.4 UPGRADE A vulnerability has been found in FastCMS up to 0.1.5 and classified as problematic
CVE-2024-7733 LOW 3.5 UPGRADE A vulnerability, which was classified as problematic, was found in FastCMS up to 0.1.5
CVE-2023-1111 LOW 2.4 UPGRADE A vulnerability was found in FastCMS up to 0.1.5 and classified as problematic

References

← Back to latest CVEs