CVE-2025-2976: GFI KerioConnect File Upload cross site scripting
First published: Mon Mar 31 2025(Updated: )
A vulnerability was found in GFI KerioConnect 10.0.6. It has been classified as problematic. Affected is an unknown function of the component File Upload. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Credit: cna@vuldb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GFI KerioConnect |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://vuldb.com/?id.302028
- https://vuldb.com/?ctiid.302028
- https://github.com/0xs1ash/poc/blob/main/xss.md#2-when-a-file-with-a-malicious-javascript-code-in-its-name-is-uploaded-to-the-system-it-is-displayed-again-on-the-page-within-the-input-field-without-being-sanitized-this-creates-the-potential-for-an-xss-att
Frequently Asked Questions
What is the severity of CVE-2025-2976?
CVE-2025-2976 is classified as a problematic vulnerability that could allow for cross site scripting attacks.
How do I fix CVE-2025-2976?
To address CVE-2025-2976, ensure that you update GFI KerioConnect to the latest version with security patches.
What are the potential risks of CVE-2025-2976?
The risks include remote exploitation which could lead to unauthorized script execution in the context of the affected user.
Which versions of GFI KerioConnect are affected by CVE-2025-2976?
GFI KerioConnect version 10.0.6 is specifically noted as being affected by CVE-2025-2976.
Can CVE-2025-2976 be exploited remotely?
Yes, CVE-2025-2976 can be exploited remotely, allowing attackers to manipulate the system from afar.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/author
- agent/severity
- agent/event
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/gfi
- canonical/gfi kerioconnect