PatchTheCVECVE-2025-55737: flaskBlog is a blog app built with Flask
CVE-2025-55737 is a medium-severity flaw (CVSS 6.5) affecting flaskblog. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, when deleting a comment, there's no validation of the ownership of the comment. Every user can delete an arbitrary comment of another user on every post, by simply intercepting the delete request and changing the commentID. The code that causes the problem is in routes/post.py.
Why this priority
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.5 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.3% (top 78%) |
| CISA exploited list | No |
| Weakness | CWE-639 |
| Published | 2025-08-19 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-55737?
flaskblog: upgrade to newer than 2.8.0. Exact commands for each OS are on this page.
Is CVE-2025-55737 being exploited?
CVE-2025-55737 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-55737 affect?
CVE-2025-55737 affects flaskblog. Severity is medium (CVSS 6.5). flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, when deleting a comment, there's no validation of the ownership of the comment. Every user can delete an arbitrary comment of another user on every post, by simply intercepting
How urgent is CVE-2025-55737?
Priority 38/100. Public exploit reference; Remotely exploitable, no login, no user action
Software pages
Related CVEs
- CVE-2025-55736 MEDIUM 6.5 UPGRADE flaskBlog is a blog app built with Flask
- CVE-2025-55735 MEDIUM 5.4 UPGRADE flaskBlog is a blog app built with Flask
- CVE-2025-55734 MEDIUM 6.5 UPGRADE flaskBlog is a blog app built with Flask
- CVE-2025-53631 MEDIUM 5.4 UPGRADE flaskBlog is a blog app built with Flask
- CVE-2025-28104 CRITICAL 9.1 DOWNGRADE Incorrect access control in laskBlog v2.6.1 allows attackers to access all usernames via a crafted input.