A password manager makes unique passwords more manageable, and self-hosting can appeal when you want to administer the service yourself. We have previously considered Vaultwarden, alongside the broader Build Your Homelab series. A PDF-related report naming Bitwarden is also a useful reminder to check security claims and keep the complete deployment current.
There is a material qualification: the canonical record for CVE-2025-5138 is marked disputed. It should not be presented as a confirmed vault takeover or as proof that switching to Vaultwarden fixes the reported behaviour. The maintenance lesson remains useful, while the allegation and the demonstrated evidence need to be distinguished.
What the CVE record says
The canonical CVE record describes an alleged PDF-file-handler cross-site scripting issue and lists version strings 2.25.0 and 2.25.1. Its description says the existence of the vulnerability is doubted, and its tags include disputed. The record is still published; disputed does not mean that the identifier has been rejected or removed.
Those version strings should not be translated into a blanket statement that all modern Bitwarden servers are affected. Bitwarden’s own versioning guide describes its year.month.release convention and distinguishes client and server versions. Identify the actual component and installed release before applying any advisory to a deployment.
The reporter’s public issue discussion includes a researcher asking whether the demonstrated PDF JavaScript could perform security-sensitive actions. That question matters because displaying an alert from a document is different from showing access to the vault’s browser origin or secrets. The evidence does not justify inventing a fixed version for this specific disputed report.
PDF JavaScript and website XSS
PDF documents can contain JavaScript for supported document functions. Chromium’s security FAQ explains that JavaScript execution in its PDF viewer does not, by itself, establish website XSS: the PDF bindings are more limited than a normal HTML document’s and do not inherit ambient authority from the serving website, such as document.cookie.
A genuine XSS issue involves untrusted content executing with authority it should not have. Its impact depends on the vulnerable context and what the code can actually access or do. For this report, a convincing assessment would need evidence crossing the relevant security boundary, rather than treating all PDF scripting as equivalent to code running inside the logged-in vault.
This does not establish that every PDF viewer, browser or password manager is immune to vulnerabilities. Keep the browser and clients current, treat unexpected attachments carefully, and follow credible advisories for the components you use. Avoid turning a disputed finding into either a confirmed breach or an absolute safety guarantee.
Bitwarden and Vaultwarden as choices
Bitwarden provides the official client/server products, published security assessments and supported deployment paths. Self-hosting still leaves the operator responsible for the host, access, updates and recovery. Some features depend on the relevant licence or subscription; running the server yourself does not automatically unlock every commercial entitlement.
Vaultwarden is an unofficial server implementation in Rust, designed to work with official Bitwarden clients. Its upstream README calls the API implementation nearly complete, which is more accurate than a permanent 100% compatibility guarantee. Client changes can require corresponding server or bundled web-vault updates, so follow the project’s release notes and report Vaultwarden issues through its own support channels.
Its compact deployment and available features remain a compelling reason to consider it for a personal homelab. Rust and a smaller application stack are not proof that it is safer in every threat model. Evaluate the maintenance and recovery process you can sustain rather than choosing a server because another product appeared in a CVE headline.
Audits and deployment size
Vaultwarden has received external security review. Its audit page describes BSI’s assessment of version 1.30.3 and an ERNW assessment in 2024. It is inaccurate to describe the project as having no professional audits. Bitwarden also publishes assessments covering different applications and components. Read the date, scope and version of a report; an audit is not certification that every future release or your own configuration is flawless.
The official deployment options have also evolved. Bitwarden lite, formerly Unified and renamed after leaving beta in December 2025, uses a single Docker image and supports several database options, including SQLite. The vendor positions it for personal use and homelabs, with standard deployments for business contexts. Therefore, official Bitwarden should not be described as always requiring eleven containers or a universal multi-gigabyte minimum.
| Choice | Why consider it | What to verify |
|---|---|---|
| Official standard Bitwarden | Official deployment and business support path | Current requirements, entitlement and chosen deployment method |
| Bitwarden lite | Official smaller deployment for personal/homelab use | Current database, host and update guidance; intended-use limits |
| Vaultwarden | Community-maintained compact alternative | Client/web-vault compatibility, supported features and operator-maintained recovery |
Measure actual usage under your workload rather than treating an idle memory estimate as a lifetime footprint. Attachments, users, database configuration and supporting services affect storage and resource needs. Compare the whole deployment and the support arrangement, not just one container count.
Update the official deployment
Back up the installation using the matching supported procedure and review release notes before changing it. For a standard script-based Bitwarden installation, its update guide documents these commands from the installation directory:
Standard Bash installation
./bitwarden.sh updateself
./bitwarden.sh update
Standard PowerShell installation
.\bitwarden.ps1 -updateself
.\bitwarden.ps1 -update
The first command updates the installation script and its version references; the second updates the deployment accordingly. These are standard-installation commands, not a universal recipe for lite, Helm, manual or offline deployments. Follow their respective documentation. Self-hosted releases can lag cloud releases, so check what is actually available and installed.
After updating, verify the server and web versions, then test the clients you depend on. Check sign-in, synchronisation and a non-sensitive attachment. Updating one browser extension alone does not demonstrate that a self-hosted web vault and server are current.
Update and back up Vaultwarden
Vaultwarden’s database and attachments need appropriate backup handling. A plain recursive copy of an active SQLite directory is not automatically a consistent backup. The project documents SQLite backup methods, required attachments and signing/configuration files; PostgreSQL or MySQL deployments need the relevant database dump as well.
Retain a recoverable independent copy and test it. An export of selected vault items may not capture the whole server state or all files. Protect backup access and keep the credentials and recovery information you need available if the original host fails.
For a Compose deployment whose service is named vaultwarden, these update commands apply only after the backup and release-specific configuration review:
docker compose pull vaultwarden
docker compose up -d vaultwarden
Use the actual service name and configured image policy in your installation. Check the resulting server/web-vault version and client behaviour. Follow Vaultwarden’s own security advisories as well as upstream client information; switching implementations is not a substitute for either.
A practical conclusion
Vaultwarden remains an incredibly compelling alternative for people who value a compact community-maintained personal deployment. Official Bitwarden’s standard and lite options deserve consideration too. The right choice depends on support, features, compatibility and the administration you are prepared to maintain.
The PDF report is best understood as a disputed security allegation, not a demonstrated reason to abandon a password manager or a verified fix delivered by another server. Keep unique passwords, appropriate account protection, current software and tested recovery at the centre of the decision. Those habits remain valuable whichever supported deployment you choose.
