Cal.com cal.diy EUVD-2025-210506

Exploitation requires that the target run a Cal.com cal.diy build before 5.9.9 that uses the Next.js App Router with React Server Components request handling enabled - the crafted RSC (React flight protocol) request is the exact trigger. Per the CVSS vector AV:N/AC:L/AT:N/PR:N/UI:N, no special conditions beyond network reachability apply: remote, unauthenticated exploitation against default App Router configurations with no user interaction. The primary limiting factors are that the instance must be network-reachable by the attacker and running an unpatched pre-5.9.9 version with the vulnerable bundled Next.js/React packages; deployments already updated to Next.js 15.4.8/15.5.7 (i.e., cal.diy 5.9.9+) are not exploitable.

This is a genuine top-priority issue rather than an inflated high-CVSS score. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with high vulnerable and subsequent-system impact across C/I/A) describes network-reachable, low-complexity, unauthenticated, no-interaction exploitation yielding full compromise - the maximal 10.0 profile, and it is internally consistent with the description of an unauthenticated remote attacker sending a crafted RSC request. Under an SSVC lens, technical impact is total and exploitation is likely automatable given a single crafted HTTP request against default RSC handling. Signals that temper urgency: this CVE is NOT listed in CISA KEV, no EPSS score was provided, and no public proof-of-concept for cal.diy specifically was supplied - so there is no evidence of active exploitation of this product. However, because it derives from the widely-publicized upstream Next.js CVE-2025-55182 (documented in GHSA-9qr9-h5gf-34mp), exploit knowledge for the underlying flaw is broadly available, which raises real-world likelihood even absent a product-specific POC. No conflicting signals were found between the CVSS vector and the description.

An attacker locates an internet-exposed cal.diy instance running a pre-5.9.9 build and, without any account or user interaction, sends a single crafted RSC request to an App Router endpoint. The bundled vulnerable Next.js deserializes the malicious flight payload during server-side rendering, executing attacker-controlled code in the server process. Given AV:N/AC:L, this requires only network reachability and can be scripted; no product-specific public POC was provided, but the upstream Next.js flaw is publicly documented.