{"id":"CVE-2025-32931","aliases":["GHSA-qq2h-m2hj-hrff"],"url":"https://o3.security/vulnerability/CVE-2025-32931","summary":"DevDojo Voyager Argument Injection vulnerability","details":"DevDojo Voyager 1.4.0 through 1.8.0, when Laravel 8 or later is used, allows authenticated administrators to execute arbitrary OS commands via a specific php artisan command.","published":"2025-04-14T00:00:00Z","modified":"2026-07-15T01:48:59.780605435Z","cvss":{"score":9.1,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"tcg/voyager","fixedVersion":null}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/lishihihi/voyager-issue-report/"},{"type":"WEB","url":"https://github.com/thedevdojo/voyager/blob/1.8/docs/core-concepts/compass.md"},{"type":"WEB","url":"https://github.com/thedevdojo/voyager/blob/7e7e0f4f0e115d2d9e0481a86153a1ceff194c00/resources/views/compass/includes/commands.blade.php#L11-L16"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32931.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32931"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-15T01:48:59.780605435Z"}}