PILOS CVE-2025-62523

Requires a logged-in PILOS user (version before 4.8.0) to actively visit an attacker-controlled web page in the same browser session (UI:R), which then issues credentialed cross-origin requests to the victim's PILOS API endpoints (api/*, sanctum/csrf-cookie). The pre-4.8.0 config/cors.php set allowed_origins to '*' with supports_credentials true, and the HandleCors middleware reflected the Origin header. The decisive LIMITING factor is Laravel's built-in session-origin validation, which refuses to treat cross-origin requests as authenticated by default - meaning successful exploitation would additionally require a separate, currently-unknown vulnerability that bypasses Laravel's origin/session checks. Without that, the misconfiguration does not yield credentialed access.

This is a high-CVSS-on-paper but low-real-risk issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L, score 6.3) describes a network-reachable, low-complexity, unauthenticated flaw requiring user interaction with only partial confidentiality/integrity/availability impact. However, every corroborating signal points to low practical risk: EPSS is just 0.20% (9th percentile), the CVE is NOT in CISA KEV, and no public exploit code was identified. Most importantly, the vendor's own GitHub advisory (GHSA-pgfw-f4mp-5445) explicitly states that Laravel's session handling applies origin checks that prevent cross-origin requests from being authenticated by default, so the reflected-Origin CORS misconfiguration 'is not believed to be exploitable in typical PILOS deployments' absent some other unknown bypass. This is a conflict worth stating explicitly: the CVSS base metrics assume the CORS weakness translates into real credentialed cross-origin actions, but the framework-level session-origin protection breaks that assumption, making the C:L/I:L/A:L impacts largely theoretical. There is no SSVC decision data in the input. Net assessment: defense-in-depth hardening fix, not an urgent priority; patch during normal maintenance cycles.

An attacker lures an authenticated PILOS user to a malicious website, which issues cross-origin fetch requests (with credentials) to the victim's PILOS API, hoping the reflected Access-Control-Allow-Origin plus Access-Control-Allow-Credentials:true lets the browser read authenticated responses or perform actions as the victim. In practice Laravel's session-origin checks reject these cross-origin requests as unauthenticated, so the attack does not succeed in default deployments. No public exploit code was identified at the time of analysis.