CVE-2025-65109

Description

Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf and Minder Go versions from 0.0.72 to 0.0.83, Minder users may fetch content in the context of the Minder server, which may include URLs which the user would not normally have access to. This issue has been patched in Minder Helm version 0.20250203.3849+ref.fdc94f0 and Minder Go version 0.0.84.

Is your site exposed to CVE-2025-65109?

Run a free security scan — no signup, results in seconds.

Weakness Type (CWE)

CWE-830 CWE-830

References

Other References

https://github.com/mindersec/minder/commit/f770400923984649a287d7215410ef108e845af8 https://github.com/mindersec/minder/security/advisories/GHSA-6xvf-4vh9-mw47

Frequently Asked Questions

What is CVE-2025-65109? +

Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf and Minder Go versions from 0.0.72 to 0.0.83, Minder users may fetch content in the context of the Minder server, which may include URLs which the user would not normally have access to. This issue has been patched in Minder Helm version 0.20250203.3849+ref.fdc94f0 and Minder Go version 0.0.84.

How do I check if I'm vulnerable to CVE-2025-65109? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-29944 8.4

An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in …

CVE-2024-42381 8.3

os/linux/elf.rb in Homebrew brew before 4.2.20 uses ldd to load ELF files obtained from untrusted sources, which allows attackers to …

CVE-2025-64496 7.3

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.6.224 and prior contain a code …

CVE-2025-33028 6.1

In WinZip through 29.0, there is a Mark-of-the-Web Bypass Vulnerability because of an incomplete fix for CVE-2024-8811. This vulnerability allows …

CVE-2025-43703 6.1

An issue was discovered in Ankitects Anki through 25.02. A crafted shared deck can result in attacker-controlled access to the …

CVE-2025-46652 6.1

In IZArc through 4.5, there is a Mark-of-the-Web Bypass Vulnerability. When a user performs an extraction from an archive file …