TI-2025-38764 Aliases CVE-2025-62524

PILOS Exposes PHP version

LOW 24CWE-200Published 2025-10-27 · Updated 2025-10-27

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. PILOS before 4.8.0 exposes the PHP version via the X-Powered-By header, enabling attackers to fingerprint the server and assess potential exploits. This information disclosure vulnerability originates from PHP’s base image. Additionally, the PHP version can also be inferred through the PILOS version displayed in the footer and by examining the source code available on GitHub. This information disclosure vulnerability has been patched in PILOS in v4.8.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00261 17th percentileScored 2026-11-07

Fix Fixed PILOS (THM-Health): 4.8.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
THM-Health	PILOS	before 4.8.0	4.8.0	Patch available	CNA

PILOS VendorTHM-Health Affected before 4.8.0 Fixed in 4.8.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:thm:pilos::::::::	before 4.8.0	Vulnerable	THM-Health

cpe:2.3:a:thm:pilos:*:*:*:*:*:*:*:* Versions before 4.8.0 Vulnerable ·THM-Health

Remediation

Fix · CNA PILOS (THM-Health) Fixed in 4.8.0

Timeline

2026-10-02 Threatist record created from CVE-2025-62524

References

Patch 1

https://github.com/THM-Health/PILOS/commit/14655bc4f8128ffd2b3c25004b01d9a802808da8

Advisory 1

https://github.com/THM-Health/PILOS/security/advisories/GHSA-q93h-5j6h-j22x

TI-2023-25447 PILOS account takeover through password reset poisoning CVSS 3.1HIGH 8.8
TI-2025-38763 PILOS Misconfigured the Access-Control-Allow-Origin Header CVSS 3.1MEDIUM 6.3
TI-2025-38964 PILOS is missing session regeneration after password change CVSS 3.1MEDIUM 5.0
TI-2026-18318 PILOS affected by a CSRF via GET request allows unintentional termination of all active video conferences CVSS 3.1MEDIUM 4.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences