PatchTheCVEchatwoot vulnerabilities
Recent CVEs affecting chatwoot products. 7 tracked.
chatwoot has 7 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 7. Most recent: 2025-10-27. Highest priority: CVE-2025-21628 (score 45/100).
- CVE-2025-12245 MEDIUM 5.3 UPGRADE A vulnerability was identified in chatwoot up to 4.7.0
- CVE-2025-12246 MEDIUM 4.3 UPGRADE A security flaw has been discovered in chatwoot up to 4.7.0
- CVE-2025-21628 CRITICAL 9.1 UPGRADE Chatwoot is a customer engagement suite
- CVE-2024-0640 MEDIUM 4.8 UPGRADE A stored cross-site scripting (XSS) vulnerability exists in chatwoot/chatwoot versions 3.0.0 to 3.5.1
- CVE-2021-3742 HIGH 8.8 UPGRADE A Server-Side Request Forgery (SSRF) vulnerability was discovered in chatwoot/chatwoot, affecting all versions
- CVE-2021-3741 MEDIUM 5.4 UPGRADE A stored cross-site scripting (XSS) vulnerability was discovered in chatwoot/chatwoot, affecting all versions
- CVE-2021-3740 MEDIUM 6.8 UPGRADE A Session Fixation vulnerability exists in chatwoot/chatwoot versions prior to 2.4.0
FAQ
How do I fix chatwoot vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is chatwoot being exploited right now?
None of the tracked chatwoot CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which chatwoot CVE should I patch first?
CVE-2025-21628 currently ranks highest (45/100): Chatwoot is a customer engagement suite.