Exploit discussion active in current signal (2 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Crayfish is a collection of Islandora 8 microservices, one of which, Homarus, provides FFmpeg as a microservice. Prior to Crayfish version 4.1.0, remote code execution may be possible in web-accessible installations of Homarus in certain configurations. The issue has been patched in `islandora/crayfish:4.1.0`. Some workarounds are available. The exploit requires making a request against the Homarus's `/convert` endpoint; therefore, the ability to exploit is much reduced if the microservice is not directly accessible from the Internet, so: Prevent general access from the Internet from hitting Homarus. Alternatively or additionally, configure auth in Crayfish to be more strongly required, such that requests with `Authorization` headers that do not validate are rejected before the problematic CLI interpolation occurs.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
CVE-2025-25286 - Critical RCE in Islandora Crayfish/Homarus. CVSS 9.8. Exploits via /convert endpoint. Update to 4.1.0 or apply workarounds immediately. #CVE #infosec #Islandora #cvealert #100DaysOfCode #sysadmin #DevSecOps
Post summary
An urgent alert about CVE‑2025‑25286, a critical RCE in Islandora, with CVSS 9.8, recommends updating to 4.1.0 or applying workarounds immediately.
Daily updates, free CVE database with all needed for experts at no cost, all needed POC, Yara, Sigma Rules, etc., updated each hour https://www.valtersit.com/cve/CVE-2025-25286/
Post summary
The post promotes a daily‑updated CVE database that includes CVE‑2025‑25286 and offers PoC, Yara, and Sigma rules for experts, but it does not provide exploit code, patch information, or evidence of active exploitation.