---
title: "Security digest: February 20, 2025"
url: https://erroneo.us/security/2025-02-20/
description: "February 20, 2025 vulnerability digest: 2 CISA KEV additions (Craft CMS, Palo Alto Networks); 5 critical advisories (Maven, crates.io (Rust), npm). What to…"
type: security-digest-day
section: "Security Digest"
date_published: 2025-02-20
date_modified: 2025-02-20
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: February 20, 2025

2 known exploited (cisa kev) additions and 5 critical advisories.

## Take stock

- Do you run any of these? Craft CMS Craft CMS, Palo Alto Networks PAN-OS. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-03-13.
- crates.io (Rust): 3 critical advisories ( namada-apps ). Check with cargo audit .
- Maven: 1 critical advisory ( org.xwiki.platform:xwiki-platform-search-solr-ui ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- npm: 1 critical advisory ( docsgpt ). Check with npm audit (or: npm ls <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2025-23209](https://erroneo.us/security/cve/CVE-2025-23209/index.md) Craft CMS Craft CMS: Craft CMS Code Injection Vulnerability (CISA due 2025-03-13)
- [CVE-2025-0111](https://erroneo.us/security/cve/CVE-2025-0111/index.md) Palo Alto Networks PAN-OS: Palo Alto Networks PAN-OS File Read Vulnerability (CISA due 2025-03-13)

## Critical advisories

- [CVE-2025-24893](https://erroneo.us/security/cve/CVE-2025-24893/index.md) XWiki Platform allows remote code execution as guest via SolrSearchMacros request — Maven org.xwiki.platform:xwiki-platform-search-solr-ui >= 5.3-milestone-2, < 15.10.11 → 15.10.11; Maven org.xwiki.platform:xwiki-platform-search-solr-ui >= 16.0.0-rc-1, < 16.4.1 → 16.4.1
- [GHSA-f8qm-hmm3-fv7f](https://erroneo.us/security/ghsa/GHSA-f8qm-hmm3-fv7f/index.md) Namada-apps allows Excessive Computation in Mempool Validation — crates.io (Rust) namada-apps = 1.0.0 → 1.1.0
- [CVE-2025-0868](https://erroneo.us/security/cve/CVE-2025-0868/index.md) DocsGPT Allows Remote Code Execution — npm docsgpt >= 0.8.1, <= 0.12.0 → no fix
- [GHSA-82vg-5v4f-f9wq](https://erroneo.us/security/ghsa/GHSA-82vg-5v4f-f9wq/index.md) Namada-apps can Crash with Excessive Computation in Mempool Validation — crates.io (Rust) namada-apps = 1.0.0 → 1.1.0
- [GHSA-2gw2-qgjg-xh6p](https://erroneo.us/security/ghsa/GHSA-2gw2-qgjg-xh6p/index.md) Namada-apps allows Post-Genesis Validator Bypass — crates.io (Rust) namada-apps = 1.0.0 → 1.1.0

---
Source page: https://erroneo.us/security/2025-02-20/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt