CVE-2025-9747: Koillection csrf_protection_controller.js cross-site request forgery
A vulnerability has been found in Koillection up to 1.6.18. Affected is an unknown function of the file assets/controllers/csrfprotectioncontroller.js. Such manipulation leads to cross-site request forgery. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.7.0 is able to address this issue. The name of the patch is 9ab8562d3f1e953da93fed63f9ee802c7ea26a9a. It is suggested to upgrade the affected component. The vendor explains: "I ended up switching to a newer CSRF handling using stateless token."
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-9747?
CVE-2025-9747 has been classified as a significant cross-site request forgery vulnerability.
How do I fix CVE-2025-9747?
To fix CVE-2025-9747, upgrade Koillection to version 1.6.19 or later.
What type of attack does CVE-2025-9747 enable?
CVE-2025-9747 enables remote cross-site request forgery attacks on affected systems.
Which versions of Koillection are affected by CVE-2025-9747?
Koillection versions up to and including 1.6.18 are affected by CVE-2025-9747.
Where is the vulnerable function located for CVE-2025-9747?
The vulnerable function for CVE-2025-9747 is located in the file assets/controllers/csrf_protection_controller.js.