PatchTheCVEtianti vulnerabilities and fixes
Recent CVEs affecting tianti, with upgrade or downgrade steps. 5 tracked.
tianti has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2025-09-01. Highest priority: CVE-2025-25907 (score 39/100).
- CVE-2025-9795 MEDIUM 6.3 UPGRADE A vulnerability has been found in xujeff tianti 天梯 up to 2.3
- CVE-2025-8807 MEDIUM 6.3 UPGRADE A vulnerability was found in xujeff tianti 天梯 up to 2.3
- CVE-2025-27910 HIGH 8.0 DOWNGRADE tianti v2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /user/ajax/upd/sta
- CVE-2025-25908 MEDIUM 5.4 DOWNGRADE A stored cross-site scripting (XSS) vulnerability in tianti v2.3 allows attackers to execute arbitrary web scr
- CVE-2025-25907 HIGH 8.8 DOWNGRADE tianti v2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /user/ajax/save
FAQ
How do I fix tianti vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is tianti being exploited right now?
None of the tracked tianti CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which tianti CVE should I patch first?
CVE-2025-25907 currently ranks highest (39/100): tianti v2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /user/ajax/save.