CVE-2025-67419: Evershop

High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days.

A Denial of Service (DoS) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application server's resources via the "GET /images" API. The application fails to limit the height of the use-element shadow tree or the dimensions of pattern tiles during the processing of SVG files, resulting in unbounded resource consumption and system-wide denial of service.

Affected products

• Evershop Evershop: up to and including 2.1.0

Published 2026-01-05. Last modified 2026-06-17.