RCE Confirmed via Umami Dependency (Next.js CVE-2025-66478) #3852
Description
Describe the Bug
I am reporting this to confirm that a critical vulnerability in Next.js (CVE-2025-66478) led to a root-level compromise on my server, where Umami was running.
I understand Umami has released a fix, but this report serves to:
- Validate the vector: Confirm the RCE was exploitable through Umami's use of the vulnerable Next.js version.
- Alert the community: Share the attacker's observed post-exploitation steps, which may help others detect a compromise.
🔎 Attacker Post-Exploitation Activity
After gaining root access, the attacker deployed the following stealthy persistence mechanisms:
- Cron Jobs
- Modified Shell Profiles (e.g., .bashrc)
- Untracked binary "hash" inside the local Umami project
✅ Action & Recommendation
My server was rebuilt completely to ensure integrity.
I recommend users on old versions not only update Umami but also perform a deep integrity check for persistence files if they suspect a past compromise.
Thank you for the prompt update to the Umami codebase.
Database
PostgreSQL
Relevant log output
Which Umami version are you using? (if relevant)
2.19.0
Which browser are you using? (if relevant)
Chrome
How are you deploying your application? (if relevant)
Hetzner
Metadata
Metadata
Assignees
Labels
No labels
Type
Projects
Milestone
Relationships
Development
No branches or pull requests
Participants
Activity
amorgner commentedon Dec 7, 2025
Can confirm, happened on one of my servers, too, where Umami was running inside a docker container.
I discovered the following processes inside the umami docker container:
Also, the fghgf seems to span a health check process:
Content of the /tmp dir of the docker container:
I have saved everything from the docker container (/tmp, /var/tmp/ /home/nextjs) for evidence.
MichaelBelgium commentedon Dec 8, 2025
Duplicate of #3839 , was already confirmed back then
And already patched in 3.0.2 (3 days ago) or 2.20.0 (2 days ago)
jowo-io commentedon Dec 14, 2025
We recently had an incident where our umami frontend was triggerering popups which would open a gambling site. updated the server and the issue stopped. The popups were also being triggered on the main site that was importing the umami analytics script. Currently digging into the issue
nospi commentedon Dec 16, 2025
Hi @amorgner I've been hit with the same thing, same filenames but a different IP for the C2 server - hosted on AWS.
It was running in memory and had cleaned up the files under /tmp. I recovered the binary, but not the config.json.
What contents did you find in the files under /tmp? Presuming it was running some kind of crypto mining rig or something?