UpHeron
All vulnerabilities

Servers and applications

CVE-2025-54571

Insufficient Return Value Handling on ModSecurity leads to XSS and Source Code Disclosure

Severity
Medium 6.9
Published
5 Aug 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.9.12
Also known as
GHSA-cg44-9m43-3f9v
Sources
NVD, Project advisories (GitHub)

Description

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response’s Content-Type, which could lead to several issues depending on the HTTP scenario. For example, we have demonstrated the potential for XSS and arbitrary script source code disclosure in the latest version of…

Affected software

SoftwareAffected versions
ModSecurityServers and applications · cpe:a:owasp:modsecurity
  • From 2.0.0 before 2.9.12
ModSecurityServers and applications · github:owasp-modsecurity/modsecurity
  • Every version before 2.9.12

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-54571
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-54571
  • GitHub Advisory Database https://github.com/advisories/GHSA-cg44-9m43-3f9v
  • github.com https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-cg44-9m43-3f9v