Evershop
CVE-2025-67419
HIGH
GHSA-m2q5-xhqg-92r2
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Excessive platform resource consumption
|
| Impact | CVSS 7.5 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None. Exploitation no authentication required. |
| Exploit ScenarioDerived | An attacker without authentication could exploit this vulnerability to exhaust the application server's resources via the "GET /images" API. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Evershop contains a vulnerability that allows attackers to exhaust the application server's resources via the "GET /images" API (CVSS 7.5).
RemediationAI
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
affects Evershop. A Denial of Service (DoS) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application server's resources via the "GET /images" API. The application fails to limit the height of the use-element shadow tree or the dimensions of pattern tiles during the processing of SVG files, resulting in unbounded resource consumption and system-wide denial of service.
Know when Evershop gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
A Denial of Service (DoS) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application server's resources via the "GET /images" API. The application fails to limit the height of the use-element shadow tree or the dimensions of pattern tiles during the processing of SVG files, resulting in unbounded resource consumption and system-wide denial of service.
Executive ViewAI
CVE-2025-67419 presents notable security risk rated CVSS 7.5. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and consider compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
EverShop 2.0.1 allows a remote unauthenticated attacker to upload arbitrary files and create directories via the /api/im
Information disclosure in EverShop e-commerce platform before 2.1.1 through the Forgot Password functionality. API respo
SQL injection in EverShop e-commerce platform during category update/deletion event handling. Path/request_path values i
An issue in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information and execu
An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.8. Rated critical severity (CVSS 9.1
Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensit
Lack of authentication in NPM's package @evershop/evershop before version 1.0.0-rc.8, allows remote attackers to obtain
A vulnerability was detected in EverShop up to 2.0.1. Rated medium severity (CVSS 6.3), this vulnerability is remotely e
A Blind Server-Side Request Forgery (SSRF) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to
Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensi
Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensi
Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensi
Exploit-DB