PlaciPy 在状态改变的端点缺少 CSRF 保护

A successful CSRF attack against PlaciPy could allow an attacker to manipulate placement data, modify user accounts, or perform other administrative actions as the logged-in user. This could result in unauthorized changes to student placements, incorrect course assignments, or even the compromise of user credentials. The potential impact is significant, especially in environments where PlaciPy manages sensitive student information. While no specific real-world exploits have been publicly reported for PlaciPy, CSRF vulnerabilities are commonly exploited, and the lack of protection in this system presents a clear risk.

Educational institutions using PlaciPy version 1.0.0 are at direct risk. Specifically, institutions relying on PlaciPy for managing student placements and course assignments are vulnerable. Shared hosting environments where PlaciPy is deployed could also be impacted if multiple applications share the same domain and are susceptible to CSRF attacks.

• python / server:

# Check for PlaciPy version 1.0.0 or earlier
pip show placipy

• generic web:

# Check for vulnerable endpoints (example - adjust to PlaciPy's structure)
curl -I https://example.com/placement/modify

1. 2026-02-09Disclosure

   disclosure

1. 已保留2026-02-05
2. 发布日期2026-02-09
3. 修改日期2026-02-10
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2026-25812 is to upgrade PlaciPy to version 1.0.1 or later, which includes a fix for the CSRF vulnerability. If upgrading is not immediately feasible, consider implementing a temporary workaround by adding CSRF protection mechanisms to all sensitive endpoints. This could involve implementing token-based authentication or other CSRF prevention techniques. Additionally, educate users about the risks of clicking on suspicious links or opening untrusted emails to minimize the likelihood of exploitation. After upgrade, confirm by testing key placement modification functions with a separate user account to ensure CSRF protection is active.