CVE-2025-24026— iTop Inefficient Regular Expression Complexity vulnerability
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-24026
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
iTop Inefficient Regular Expression Complexity vulnerability
Source: NVD (National Vulnerability Database)
Vulnerability Description
iTop is an web based IT Service Management tool. Versions prior to 3.2.1 are vulnerable to regular expression denial of service (ReDoS) that may, under some circumstances, affect iTop server. Version 3.2.1 doesn't use the affected variable in the regular expression. As a workaround, if iTop app_root_url is defined in the configuration file, then there is no possible way to exploit this ReDoS.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
CWE-1333
Source: NVD (National Vulnerability Database)
Vulnerability Title
iTop 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
iTop是Combodo开源的一个简单的、基于 Web 的 IT 服务管理工具。 iTop 3.2.1之前版本存在安全漏洞，该漏洞源于正则表达式拒绝服务可能影响服务器。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-24026
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-24026
请登录查看更多情报信息。
Same Patch Batch · Combodo · 2025-05-14 · 7 CVEs total
| CVE-2025-24022 | 8.6 HIGH | iTop server vulnerable to portal code injection |
| CVE-2024-52601 | 6.5 MEDIUM | iTop portal Insecure Direct Object Reference vulnerability |
| CVE-2024-56157 | 6.3 MEDIUM | iTop vulnerable to Self XSS in CSV Import |
| CVE-2025-24021 | 5.0 MEDIUM | iTop doesn't have mass assignment of fields in the portal form |
| CVE-2025-24969 | 5.0 MEDIUM | iTop portal user can see any other contact's picture |
| CVE-2025-24785 | 4.3 MEDIUM | iTop dashboard vulnerable to denial of service |
IV. Related Vulnerabilities
Same product: iTop
- CVE-2025-64167
Combodo iTop vulnerable to reflected XSS in webservices/expo - CVE-2025-49145
iTop admin can drop iTop database using webhooks - CVE-2025-48878
Combodo iTop vulnerable to IDOR with ModuleInstallation obje - CVE-2025-48065
Combodo iTop vulnerable to reflected XSS via objection editi - CVE-2025-48055
Combodo iTop has stored XSS in user portal's browse brick
Same vendor: Combodo
- CVE-2025-64167
Combodo iTop vulnerable to reflected XSS in webservices/expo - CVE-2025-49145
iTop admin can drop iTop database using webhooks - CVE-2025-48878
Combodo iTop vulnerable to IDOR with ModuleInstallation obje - CVE-2025-48065
Combodo iTop vulnerable to reflected XSS via objection editi - CVE-2025-48055
Combodo iTop has stored XSS in user portal's browse brick
Same weakness: CWE-1333
- CVE-2026-33079
Mistune ReDoS in LINK_TITLE_RE allows denial of service with - CVE-2026-41040
GROWI 安全漏洞 - CVE-2026-40319
Giskard has a Regular Expression Denial of Service (ReDoS) i - CVE-2026-5986
Zod jsVideoUrlParser util.js getTime redos - CVE-2026-35041
ReDoS in fast-jwt when using RegExp in allowed* leading to C
V. Comments for CVE-2025-24026
No comments yet