CVE-2025-62369: Xibosignage Xibo RCE Vulnerability

CVE-2025-62369 Overview

Xibo is an open source digital signage platform with a web content management system (CMS). CVE-2025-62369 is a Remote Code Execution (RCE) vulnerability in the CMS Developer menu's Module Templating functionality. The flaw affects Xibo versions 4.3.0 and below. Authenticated users with System -> Add/Edit custom modules and templates permissions can manipulate Twig filters and execute arbitrary server-side functions as the web server user. The vulnerability is classified under [CWE-94] Improper Control of Generation of Code (Code Injection). Xibo Signage released version 4.3.1 to remediate the issue.

Critical Impact
Authenticated administrators can execute arbitrary code on the underlying server, leading to full compromise of the Xibo CMS host and any connected digital signage infrastructure.

Affected Products

Xibo CMS versions 4.3.0 and below
Xibo CMS 4.2.x (workaround via patch commits)
Xibo CMS 4.1.x (workaround via patch commits)

Discovery Timeline

2025-11-04 - CVE-2025-62369 published to NVD
2025-12-08 - Last updated in NVD database

Technical Details for CVE-2025-62369

Vulnerability Analysis

The vulnerability resides in the Module Templating feature exposed through the CMS Developer menu. Xibo renders widget templates with the Twig templating engine and applies a Twig SandboxExtension with a SecurityPolicy to constrain available filters, functions, and tags. The pre-patch policy did not register all required Twig filters and allowed tags within the sandbox. This omission let an authenticated operator craft template content that invoked filters or callables outside the intended allow-list. The downstream effect was execution of arbitrary server-side PHP functions in the context of the web server user.

Root Cause

The root cause is incomplete enforcement of the Twig sandbox security policy in lib/Widget/Render/WidgetHtmlRenderer.php. Missing filter registrations and allowed tag definitions permitted unsafe Twig constructs to pass policy checks. Because the Module Templating UI accepts template source from privileged users, those inputs reach the renderer without sufficient validation. This pattern maps to [CWE-94] Improper Control of Generation of Code.

Attack Vector

Exploitation requires an authenticated session with the System -> Add/Edit custom modules and templates permission. The attacker navigates to the Developer menu, edits a module template, and embeds malicious Twig that invokes filters resolving to arbitrary PHP callables. When the template renders, the server executes the attacker-supplied logic as the web server user.

php

// Patch excerpt from lib/Widget/Render/WidgetHtmlRenderer.php
 use Slim\Views\Twig;
 use Twig\Extension\SandboxExtension;
 use Twig\Sandbox\SecurityPolicy;
+use Twig\TwigFilter;
 use Xibo\Entity\Module;
 use Xibo\Entity\ModuleTemplate;
 use Xibo\Entity\Region;
// Source: https://github.com/xibosignage/xibo-cms/commit/0f4e88396111ea027785a48dd8f5eeb14536bd71

The patch imports TwigFilter and registers the missing filter set and allowed tags so that template rendering is fully constrained by the sandbox policy.

Detection Methods for CVE-2025-62369

Indicators of Compromise

Unexpected edits to module templates in the Xibo CMS audit log, especially by accounts with Add/Edit custom modules and templates permissions.
New or modified files in the Xibo web root or library directory that do not correspond to scheduled content uploads.
Outbound network connections from the web server process (PHP-FPM, Apache, or Nginx worker) to attacker-controlled infrastructure.
Web server processes spawning child shells such as sh, bash, or python during template rendering operations.

Detection Strategies

Review Xibo CMS audit logs for module template creation and update events, correlating against an approved change list.
Monitor PHP process telemetry for execution of system functions like exec, system, passthru, or proc_open originating from Twig rendering paths.
Inspect saved module template payloads for suspicious Twig filter usage referencing PHP callables.

Monitoring Recommendations

Enable verbose logging on the CMS Developer menu and alert on any access outside maintenance windows.
Forward web server and PHP error logs to a centralized SIEM for correlation with file system and process events.
Baseline the set of accounts holding the templating permission and alert when membership changes.

How to Mitigate CVE-2025-62369

Immediate Actions Required

Upgrade Xibo CMS to version 4.3.1 or later as soon as possible.
Audit all user accounts that hold the System -> Add/Edit custom modules and templates permission and revoke it where not required.
Rotate credentials and API tokens used by the Xibo CMS host if compromise is suspected.
Inspect existing module templates for Twig content that references unfamiliar filters or callables and remove suspect entries.

Patch Information

Xibo Signage fixed the issue in version 4.3.1. The remediation is delivered in commits 0f4e88396111ea027785a48dd8f5eeb14536bd71 and ecd4f9d2cea739a46756a108a839cac80f65cf10, which register the missing Twig filters and allowed tags inside the sandbox policy in lib/Widget/Render/WidgetHtmlRenderer.php. Details are published in the GitHub Security Advisory GHSA-7rmm-689c-gjgv and the Xibo 4.3.1 release notes.

Workarounds

For deployments pinned to the 4.1 or 4.2 branch, apply the upstream patch commits referenced in the advisory rather than upgrading.
Restrict the System -> Add/Edit custom modules and templates permission to a minimal set of trusted administrators.
Place the Xibo CMS administrative interface behind a VPN or IP allow-list to reduce exposure to credential theft.

bash

# Verify the running Xibo CMS version and upgrade via Docker
docker compose pull
docker compose down
docker compose up -d
# Confirm the deployed version is 4.3.1 or later
curl -s https://<xibo-host>/about | grep -i version