CVE-2025-29993: PowerCMS HTTP Header Injection Flaw

CVE-2025-29993 Overview

CVE-2025-29993 is an HTTP header injection vulnerability affecting multiple versions of PowerCMS, a Japanese enterprise content management system. Attackers can exploit this flaw to manipulate HTTP headers processed by the application. The most impactful attack scenario involves tampering with URLs embedded in outbound email, including password reset messages sent by the platform.

The vulnerability is categorized under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). Exploitation requires no authentication and can be performed remotely over the network.

Critical Impact
Remote attackers can inject crafted content into HTTP headers to alter URLs sent in system-generated email such as password reset links, enabling redirection to attacker-controlled destinations.

Affected Products

PowerCMS versions prior to 6.61
PowerCMS versions prior to 5.28
PowerCMS versions prior to 4.59

Discovery Timeline

2025-03-27 - CVE-2025-29993 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-29993

Vulnerability Analysis

The vulnerability stems from insufficient neutralization of user-controlled input that is later reflected into HTTP headers generated by PowerCMS. When PowerCMS constructs email messages such as password reset notifications, it derives URLs from request context that an attacker can influence.

Because the application does not properly sanitize header content, an attacker can supply crafted values that manipulate the URL delivered to the recipient. A victim who clicks the tampered link may reach an attacker-controlled host that mimics the legitimate password reset flow.

The issue aligns with [CWE-74], covering improper neutralization of special elements in output. Consult the JVN #39026557 advisory for coordinated disclosure details.

Root Cause

PowerCMS constructs outbound URLs and header values using request-derived data such as the Host header without adequate validation. Trusting client-controlled input in a security-sensitive email flow creates the injection primitive that enables link tampering.

Attack Vector

An unauthenticated attacker submits a request to the password reset endpoint while manipulating headers that PowerCMS reflects into the outgoing email. The victim receives a legitimate-looking message containing a URL pointing to an attacker-controlled domain. Following the link can expose reset tokens or credentials.

No verified proof-of-concept code has been published. Refer to the PowerCMS release notes for vendor-supplied technical context.

Detection Methods for CVE-2025-29993

Indicators of Compromise

Outbound password reset emails containing URLs that do not match the canonical PowerCMS hostname
HTTP requests to PowerCMS password reset endpoints containing unexpected or spoofed Host header values
User reports of password reset links redirecting to unfamiliar domains

Detection Strategies

Inspect web server access logs for requests to password reset endpoints where the Host header differs from allowed values
Correlate mail server logs with web application logs to identify emails containing anomalous embedded URLs
Deploy web application firewall rules that flag header values containing CRLF sequences or unexpected characters

Monitoring Recommendations

Alert on outbound SMTP traffic from PowerCMS that references domains outside an approved allowlist
Track failed and successful password reset workflows for statistical anomalies indicating automated abuse
Retain HTTP request headers for the password reset flow to support post-incident forensic review

How to Mitigate CVE-2025-29993

Immediate Actions Required

Upgrade PowerCMS to version 6.61, 5.28, or 4.59 depending on the deployed release line
Audit recent password reset emails for tampered URLs and force resets where suspicious activity is confirmed
Restrict the Host header at the reverse proxy layer to an explicit list of production hostnames

Patch Information

The vendor released fixed versions on the release channel documented in the PowerCMS release announcement. Administrators should apply version 6.61, 5.28, or 4.59 based on their current major release. Review the JVN #39026557 advisory for coordinated disclosure guidance.

Workarounds

Configure the fronting web server or load balancer to reject requests with Host headers not on an approved allowlist
Hardcode the canonical site URL in PowerCMS configuration rather than deriving it from request headers where possible
Add CRLF and header-injection filtering rules at the WAF to block malformed header content

bash

# Nginx example: enforce a strict Host header allowlist
server {
    listen 443 ssl;
    server_name cms.example.com;

    if ($host !~* ^(cms\.example\.com)$) {
        return 444;
    }

    location / {
        proxy_set_header Host cms.example.com;
        proxy_pass http://powercms_backend;
    }
}