CVE-2025-41694

Medium · 6.5

CVSS

6.5

EPSS

0.5%

Published

Dec 9, 2025

CISA due date

—

The record

A low privileged remote attacker can run the webshell with an empty command containing whitespace. The server will then block until it receives more data, resulting in a DoS condition of the websserver.

Affected packages

Ecosystem	Package	Introduced	Fixed