CVE-2025-2218 is a medium severity improper access control flaw (CVSS 5.3) in LoveCards LoveCardsV2 up to version 2.3.2. The /api/system/other setting handler can be reached without proper checks. No fixed version is named, so limit who can call the API.
What's affected
- Product: LoveCards LoveCardsV2
- Affected versions: up to and including 2.3.2
- Vulnerable component: the Setting Handler behind
/api/system/other - CVSS: 5.3 (Medium), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Published: 2025-03-12
The record says no privileges are needed and that the exploit has been disclosed to the public. It also says the vendor was contacted early and did not respond. The CISA Known Exploited Vulnerabilities flag is false for this CVE, and none of the pages I read report active exploitation.
One of the references is a write up whose title mentions an unauthenticated path to remote code execution. I could not load that page, so I cannot confirm what it shows, and the CVSS score for this CVE only rates a low integrity impact. Treat that title as a reason to look closely, not as established fact.
How to check if you're exposed
LoveCards is a self hosted application, so check it directly.
- Find the installed version in the admin interface or the project files. Anything up to 2.3.2 is affected.
- Test from outside your network whether
/api/system/otheranswers. If it does, ask whether it should. - Look at your reverse proxy or web server logs for requests to that path, and compare the sources with your known admin addresses.
- Compare current system settings with your last known good configuration, because the endpoint handles settings.
You can run a free in-browser dependency scan on the project's dependency files, which covers the libraries rather than this handler.
What to do now
- Find every LoveCardsV2 deployment and record its version.
- Block
/api/system/otherat the proxy for anyone who is not an administrator on a trusted address. - Review system settings and recent changes for anything you did not make.
- Watch the project for a release after 2.3.2 and read its notes before upgrading. The vendor has not responded to the disclosure, so a fix may not arrive.
- If you cannot restrict the endpoint, consider taking the application offline until you can.
Why it matters
The record lists CWE-284, improper access control, and CWE-266, incorrect privilege assignment. A function that changes system level settings is available to callers who have not proven they are allowed to use it.
Access control bugs are quiet. There is no crash and no strange input, only a request that should have been refused and was not. The fix is a server side check on every administrative route, and the lasting lesson is to deny by default so a new route is closed until someone opens it on purpose.
Quick check
Is CVE-2025-2218 the same as the remote code execution write up?
I could not load the referenced write up, so I cannot say. The CVE record describes improper access control with a low integrity impact only.
Is a patch available?
The record names no fixed version and says the vendor did not respond.
Sources
Last reviewed: 19 October 2026.
