CVE-2025-62369: Xibosignage Xibo

High severity, CVSS 7.2. EPSS: 1% chance of exploitation in the next 30 days.

Xibo is an open source digital signage platform with a web content management system (CMS). Versions 4.3.0 and below contain a Remote Code Execution vulnerability in the CMS Developer menu's Module Templating functionality, allowing authenticated users with "System -> Add/Edit custom modules and templates" permissions to manipulate Twig filters and execute arbitrary server-side functions as the web server user. This issue is fixed in version 4.3.1. To workaround this issue, use the 4.1 and 4.2 patch commits.

Affected products

• Xibosignage Xibo: from 4.1.0, before 4.3.1 (fixed in 4.3.1)

Published 2025-11-04. Last modified 2026-06-17.