Paper/Archive/CVE-2025-32931

CVE-2025-32931

DevDojo Voyager — DevDojo Voyager 1.4.0 through 1.8.0, when Laravel 8 or later is used, allows authenticated administrators to execute arbitrary OS command…

EPSS 0.6%public exploit CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (CNA)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 47.2.472 × 209.4 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

DevDojo Voyager 1.4.0 through 1.8.0, when Laravel 8 or later is used, allows authenticated administrators to execute arbitrary OS commands via a specific php artisan command.

Affected

ProductAffectedFixed inSource

Voyager1.4.0 – 1.8.0–CNA

Scores by source

mitre (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refgithub.com/lishihihi/voyager-issue-report refgithub.com/thedevdojo/voyager/blob/1.8/docs/core-concepts/compass.md refgithub.com/thedevdojo/voyager/blob/7e7e0f4f0e115d2d9e0481a86153a1ceff194c00/resources/views/compass/includes/commands.blade.php#L11-L16