PILOS CVE-2025-62524

No special conditions - remote unauthenticated requests against default configurations of PILOS before 4.8.0 return the X-Powered-By header exposing the PHP version, a default behavior of the upstream PHP base image. What limits the real-world value of exploitation: the vulnerability discloses only the PHP version (no credentials, data, or code), and that same version is independently obtainable from the PILOS version string in the application footer and from the public GitHub source, so the header leak provides no privileged information beyond what is already public.

This is a low-severity information disclosure (CVSS 5.3, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) that is a high-CVSS-but-low-real-risk issue - in fact the CVSS is already modest. All signals point the same direction: the vector is network-reachable and unauthenticated, but impact is limited to confidentiality (C:L) with no integrity or availability effect, and the only data disclosed is the PHP version via the X-Powered-By header. EPSS reinforces low urgency at 0.26% (16th percentile), and there is no CISA KEV listing and no public exploit identified at time of analysis. Critically, the vendor's own advisory notes the same PHP-version information is already obtainable by other means - the PILOS version shown in the footer and the publicly available source on GitHub - so even successful exploitation reveals nothing an attacker could not otherwise derive. No SSVC decision data was supplied in the input. There are no conflicting signals: this is a fingerprinting/hardening finding, not an actively exploited priority. It warrants patching to v4.8.0 as routine hygiene rather than emergency response.

An unauthenticated attacker sends an ordinary HTTP request to a PILOS instance and reads the X-Powered-By response header, which leaks the exact PHP version inherited from the PHP base image. The attacker uses this to shortlist version-specific PHP exploits before attempting a real intrusion. No public exploit is required or identified; the disclosure is passive and the same version can also be inferred from the footer or GitHub source.