{"id":"CVE-2025-9162","url":"https://www.cyber-defence.io/tools/cve/CVE-2025-9162","generatedAt":"2026-10-27T23:08:59.183Z","title":"This substitution process allows for injection attacks when crafted realm documents are processed.","description":"A flaw was found in org.keycloak/keycloak-model-storage-service. The KeycloakRealmImport custom resource substitutes placeholders within imported realm documents, potentially referencing environment variables. This substitution process\nallows for injection attacks when crafted realm documents are processed. An attacker can leverage this to inject malicious content during the realm import procedure. This can lead to unintended consequences within the Keycloak environment.","published":"2025-08-21T16:15:35.000Z","lastModified":"2026-06-17T10:08:27.000Z","status":"Deferred","sourceIdentifier":"secalert@redhat.com","cvss":{"version":"3.1","score":4.9,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"},"cwe":["CWE-526"],"affected":[],"epss":{"score":0.00518,"percentile":0.4377,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.52%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://access.redhat.com/errata/RHSA-2025:15336","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:15337","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:15338","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:15339","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:16399","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:16400","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2025-9162","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2389396","source":"secalert@redhat.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-9162","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}