CVE-2025-25286

Crayfish is a collection of Islandora 8 microservices, one of which, Homarus, provides FFmpeg as a microservice. Prior to Crayfish version 4.1.0, remote code execution may be possible in web-accessible installations of Homarus in certain configurations. The issue has been patched in `islandora/crayfish:4.1.0`. Some workarounds are available. The exploit requires making a request against the Homarus's `/convert` endpoint; therefore, the ability to exploit is much reduced if the microservice is not directly accessible from the Internet, so: Prevent general access from the Internet from hitting Homarus. Alternatively or additionally, configure auth in Crayfish to be more strongly required, such that requests with `Authorization` headers that do not validate are rejected before the problematic CLI interpolation occurs.

• CWE-150
• CWE-157

• https://github.com/Islandora/Crayfish/commit/64cb4cec688928798cc40e6f0a0e863d7f69fd89
• https://github.com/Islandora/Crayfish/security/advisories/GHSA-mm6v-68qp-f9fw

Published

Feb 13, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-25280Buffer overflow vulnerability exists in FutureNet AS series …5.3
• CVE-2025-25281An attacker may modify the URL to discover sensitive informa…7.5
• CVE-2025-25282RAGFlow is an open-source RAG (Retrieval-Augmented Generatio…8.1
• CVE-2025-25283parse-duraton is software that allows users to convert a hum…7.5
• CVE-2025-25284The ZOO-Project is an open source processing platform, relea…8.7
• CVE-2025-25285@octokit/endpoint turns REST API endpoints into generic requ…5.3
• CVE-2025-25287Lakeus is a simple skin made for MediaWiki. Starting in vers…4.7
• CVE-2025-25288@octokit/plugin-paginate-rest is the Octokit plugin to pagin…5.3
• CVE-2025-25289@octokit/request-error is an error class for Octokit request…5.3
• CVE-2025-2529Applications using affected versions of Ehcache 3.x can expe…3.7
• CVE-2025-25290@octokit/request sends parameterized requests to GitHub’s AP…5.3
• CVE-2025-25291ruby-saml provides security assertion markup language (SAML)…9.8