CVE-2025-71454: vtenext before 25.02.2 CSRF Protection Bypass via HTTP Method Tampering
vtenext before 25.02.2 contains a cross-site request forgery protection bypass because csrfcheck() in include/utils/VteCsrf.php skips csrftoken validation for non-POST requests. Attackers can induce a logged-in user to open a crafted link sending state-changing GET requests, which handlers read from $REQUEST, performing actions as that user.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of vtenext versions before 25.02.2 are exposed when they are logged in and can be persuaded to open an attacker-controlled link. The attack is performed through the victim's authenticated browser session.
What does an attacker need to exploit it?
No authentication or direct privileges are required for the attacker, but a target must be logged in and interact with a crafted link. The affected request must invoke a state-changing handler that accepts parameters through $_REQUEST using a non-POST HTTP method.
Are default deployments affected?
The available information identifies the flaw in csrf_check() for non-POST requests and does not state that a non-default configuration is required. Any pre-25.02.2 deployment with reachable state-changing handlers that process GET-request parameters may be affected.
How can I reduce risk if I cannot update immediately?
The supplied information does not provide a documented workaround. Risk is tied to logged-in users opening crafted links, so reducing exposure to untrusted links can help limit exploitation until vtenext is updated to 25.02.2 or later.