---
title: "CVE-2025-32931: DevDojo Voyager Argument Injection vulnerability"
url: https://erroneo.us/security/cve/CVE-2025-32931/
description: "CVE-2025-32931 (tcg/voyager (Composer (PHP))): DevDojo Voyager 1.4.0 through 1.8.0, when Laravel 8 or later is used, allows authenticated administrators to…"
type: vulnerability-record
section: "Security Digest"
date_published: 2025-04-14
date_modified: 2025-04-14
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2025-32931"
kev: false
cvss: 9.1
epss: 0.00569
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2025-32931: DevDojo Voyager Argument Injection vulnerability

**Signal:** Critical, preconditions apply. Severe if exploited, but exploitation needs conditions that may not apply to you. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- Not in CISA KEV , but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
- EPSS 0.6% , percentile 46: FIRST’s model estimates a 0.6% chance of exploitation activity in the next 30 days, higher than 46% of all scored CVEs (low). EPSS is a probability, not a verdict.
- Needs an account (high (admin)). Exposure depends on who can log in.
- Only applies if your dependency tree includes tcg/voyager (Composer (PHP)) >= 1.4.0, <= 1.8.0, no fixed version listed . Check your lockfile, including transitive dependencies.

## What it is

DevDojo Voyager 1.4.0 through 1.8.0, when Laravel 8 or later is used, allows authenticated administrators to execute arbitrary OS commands via a specific php artisan command.

## Affected packages

- Composer (PHP) `tcg/voyager` >= 1.4.0, <= 1.8.0 → fixed: none listed

## Affected products (CVE record)

- DevDojo Voyager: 1.4.0 <= 1.8.0

## Severity

- mitre CVSS 3.1: 9.1 `CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`
- GitHub CVSS 3.1: 9.1 `CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation poc , automatable yes , technical impact total .
- FIRST EPSS (model of 2026-10-21): 0.57% probability of exploitation activity in the next 30 days; percentile 46.

## Sources

- [GitHub Advisory GHSA-qq2h-m2hj-hrff](https://github.com/advisories/GHSA-qq2h-m2hj-hrff)
- [CVE.org record CVE-2025-32931](https://www.cve.org/CVERecord?id=CVE-2025-32931)
- [NVD entry CVE-2025-32931](https://nvd.nist.gov/vuln/detail/CVE-2025-32931)
- [github.com](https://github.com/lishihihi/voyager-issue-report/)
- [github.com](https://github.com/thedevdojo/voyager/blob/1.8/docs/core-concepts/compass.md)
- [github.com](https://github.com/thedevdojo/voyager/blob/7e7e0f4f0e115d2d9e0481a86153a1ceff194c00/resources/views/compass/includes/commands.blade.php#L11-L16)

---
Source page: https://erroneo.us/security/cve/CVE-2025-32931/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt