External risk intelligence

dcat-admin File Inclusion Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-65656

dcat-admin is a web-based administrative dashboard used to manage application data. As a web application interface designed for administrative access, it is commonly deployed as a web-facing service or an internal portal accessible via a network, making its interface plausibly reachable from an external-facing network context.

Dcatadmin Dcat Admin

1.7.9 and earlier2.0.0 to 2.2.3

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in the dcat-admin software, affecting versions prior to 2.2.3-beta. This issue could allow for unauthorized inclusion of files within the system, potentially impacting the confidentiality, integrity, and availability of data. The main concern is confirming whether our organization utilizes this specific software and is therefore exposed.

Vulnerability allows unauthorized file inclusion.
Confirm if this system is in use.
Understand potential impact and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by leveraging the file inclusion flaw in the VersionManager.php component. This could allow an unauthenticated attacker to gain unauthorized access to sensitive information or potentially compromise the system.

No authentication required for access.
File inclusion in VersionManager.php.
Unauthenticated remote code execution possible.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to include arbitrary files when the system is exposed to the network. This may lead to unauthorized access to sensitive system files or potentially impact the integrity and availability of the application.

System files and application integrity.
Remote file inclusion via network access.
Unauthorized access and system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

Responsible teams will likely include application owners and infrastructure or platform teams managing the dcat-admin deployment. The first practical step is to identify all instances of dcat-admin, assess their network reachability and business criticality, and then determine the specific accountable owner for each instance before planning remediation.

Application owners should prioritize this issue.
Verify network exposure and business impact first.
Plan coordinated remediation or vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is dcat-admin?

dcat-admin is a web-based dashboard used by developers to build administrative interfaces for managing application data. It provides a set of pre-built tools and components that simplify the creation of backend portals, allowing teams to perform common administrative tasks within their software projects.

What does CWE-98 mean for CVE-2025-65656?

CWE-98 refers to improper control of filename for include/require statements in PHP. In the context of CVE-2025-65656, this means the software does not properly validate user input before using it to load files. An attacker can manipulate these inputs to force the system to process unintended files, which may lead to unauthorized data access or system compromise.

How can an attacker trigger this vulnerability?

An attacker triggers this flaw by sending a specially crafted request to the VersionManager.php component. Because the application fails to require authentication, no specific credentials or prior access are needed to initiate the request. The vulnerability is not triggered by standard administrative actions or legitimate user navigation within the dashboard.

How does Halo Surface Signal categorize this threat?

Halo Surface Signal identifies this as a likely concern because dcat-admin is designed as a web-accessible dashboard. Whether deployed as a public-facing portal or an internal administrative tool, the interface is inherently reachable via network connections, which increases the likelihood that an attacker could attempt to reach the affected component.

What should I do if I use dcat-admin?

Begin by inventorying your environment to locate all instances of dcat-admin and determining which version you are running. Assess whether these instances are reachable over your network. Once identified, work with the relevant application owners to plan a patch or update, as this is the primary way to address the underlying file inclusion flaw.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.